Hybrid-AD joined devices are being blocked

%3CLINGO-SUB%20id%3D%22lingo-sub-2457533%22%20slang%3D%22en-US%22%3EHybrid-AD%20joined%20devices%20are%20being%20blocked%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2457533%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3EWe%20already%20enforce%20MFA%20access%20to%20O365%20using%20conditional%20access%20but%20we%20want%20to%20prevent%20users%20accessing%20O365%20from%20non-company%20devices.%20We%20have%20set%20a%20conditional%20access%20policy%20to%20block%20access%20using%20the%20Device%20State%20condition%20-%20%22all%20device%20state%20and%20exclude%20Device%20Hybrid%20AD%20joined%22.%20The%20issue%20is%2C%20when%20we%20enable%20this%20policy%2C%20it%20actually%20blocks%20our%20laptops%2C%20despite%20them%20being%20in%20Azure%20AD.%20The%20computers%20are%20synced%20from%20our%20on-premise%20AD%20using%20AAD%20sync.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20look%20at%20the%20sign-in%20logs%2C%20I%20notice%20that%20the%20interactive%20logs%20do%20not%20contain%20the%20device%20ID%20for%20the%20laptop%20but%20the%20non-interactive%20logs%20do%20contain%20the%20device%20ID.%20We%20also%20have%20a%20policy%20that%20excludes%20access%20to%20Yammer%20from%20MFA.%20The%20sign-in%20logs%20for%20Yammer%2C%20shows%20single-factor%20authentication%20but%20also%20picks%20up%20the%20Device%20ID%20under%20Device%20info.%20So%2C%20it%20appears%20that%20SSO%20would%20work%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20also%20appears%20to%20be%20device%20specific%2C%20as%20the%20logs%20show%20the%20device%20ID%20for%20some%20devices%20but%20not%20all.%20So%2C%20I'm%20certain%20the%20CA%20policies%20are%20working%20correctly%20and%20the%20issue%20lies%20with%20the%20device%20itself%20in%20some%20way.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20ran%20DSregcmd%20and%20the%20powershell%20scripts%20dsregtool%20and%20test-deviceregconnectivity%20but%20they%20report%20everything%20as%20working%20fine.%3C%2FP%3E%3CP%3EHas%20anyone%20seen%20this%20issue%3F%20Also%2C%20can%20anyone%20advise%2C%20other%20than%20the%20scripts%20mentioned%2C%20is%20there%20any%20other%20way%20to%20troubleshoot%20this%20issue%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMany%20thanks%20in%20advance%3C%2FP%3E%3CP%3ERoy%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2457533%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAccess%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2465144%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid-AD%20joined%20devices%20are%20being%20blocked%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2465144%22%20slang%3D%22en-US%22%3EHere%20is%20the%20troubleshooting%20documentation%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Ftroubleshoot-hybrid-join-windows-current%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Ftroubleshoot-hybrid-join-windows-current%3C%2FA%3E%3CBR%20%2F%3EWhat%20does%20the%20%22Join%20Type%22%20column%20say%20for%20the%20device%20in%20question%3F%20(Can%20you%20post%20a%20screen%20shot)%3F%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_Devices%2FDevicesMenuBlade%2FDevices%2FmenuId%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_Devices%2FDevicesMenuBlade%2FDevices%2FmenuId%2F%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2465824%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid-AD%20joined%20devices%20are%20being%20blocked%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2465824%22%20slang%3D%22en-US%22%3EI%20have%20had%20issues%20with%20this%20before%20and%20worked%20with%20a%20couple%20of%20customers%20on%20this.%20Check%20out%20the%20following%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2F365bythijs.be%2F2019%2F11%2F02%2Ftroubleshooting-hybrid-azure-ad-join%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2F365bythijs.be%2F2019%2F11%2F02%2Ftroubleshooting-hybrid-azure-ad-join%2F%3C%2FA%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2F365bythijs.be%2F2020%2F09%2F03%2Fazuread-device-not-recognized-as-hybrid-joined%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2F365bythijs.be%2F2020%2F09%2F03%2Fazuread-device-not-recognized-as-hybrid-joined%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3ETroubleshooting%20steps%20are%3A%3CBR%20%2F%3E-%20Check%20dsregcmd%20output%20for%20correct%20status%3CBR%20%2F%3E-%20Validate%20status%20in%20AAD%20portal%3CBR%20%2F%3E-%20Make%20sure%20you%20use%20supported%20applications%3CBR%20%2F%3E%3CBR%20%2F%3EOn%20the%20computers%20with%20issues%2C%20do%20all%20applications%20have%20the%20issue%20or%20only%20some%3F%3C%2FLINGO-BODY%3E
New Contributor

Hi

We already enforce MFA access to O365 using conditional access but we want to prevent users accessing O365 from non-company devices. We have set a conditional access policy to block access using the Device State condition - "all device state and exclude Device Hybrid AD joined". The issue is, when we enable this policy, it actually blocks our laptops, despite them being in Azure AD. The computers are synced from our on-premise AD using AAD sync.

 

When I look at the sign-in logs, I notice that the interactive logs do not contain the device ID for the laptop but the non-interactive logs do contain the device ID. We also have a policy that excludes access to Yammer from MFA. The sign-in logs for Yammer, shows single-factor authentication but also picks up the Device ID under Device info. So, it appears that SSO would work

 

This also appears to be device specific, as the logs show the device ID for some devices but not all. So, I'm certain the CA policies are working correctly and the issue lies with the device itself in some way. 

 

I have ran DSregcmd and the powershell scripts dsregtool and test-deviceregconnectivity but they report everything as working fine.

Has anyone seen this issue? Also, can anyone advise, other than the scripts mentioned, is there any other way to troubleshoot this issue?

 

Many thanks in advance

Roy

4 Replies
Here is the troubleshooting documentation:
https://docs.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-cur...
What does the "Join Type" column say for the device in question? (Can you post a screen shot)?
https://portal.azure.com/#blade/Microsoft_AAD_Devices/DevicesMenuBlade/Devices/menuId/
I have had issues with this before and worked with a couple of customers on this. Check out the following:
https://365bythijs.be/2019/11/02/troubleshooting-hybrid-azure-ad-join/
https://365bythijs.be/2020/09/03/azuread-device-not-recognized-as-hybrid-joined/

Troubleshooting steps are:
- Check dsregcmd output for correct status
- Validate status in AAD portal
- Make sure you use supported applications

On the computers with issues, do all applications have the issue or only some?
Hi guys

I have gone through the troubleshooting and everything appears to check out. Dsregcmd /status does not show any issues. The device is listed as enabled and "Hybrid Azure AD Joined" in the AAD portal.

If I use IE or Edge, the AAD logs show the device ID. We also have the office client apps installed but when I open up Outlook, Teams or Word they do not prompt for MFA but open up fine. However, I do not see any AAD sign-in logs, either interactive or non-interactive for these apps. If I use dsregtool or test-deviceregconnectivity, I can see the logs for these authentications and the Device ID is logged.

So, I need to understand why Outlook, Teams etc. do not show up in the AAD logs and then confirm whether these apps are sending the PRT or not.

Any suggestions?

Thanks
Roy
Have you enabled modern authentication in your tenant?