Home
%3CLINGO-SUB%20id%3D%22lingo-sub-1132441%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132441%22%20slang%3D%22en-US%22%3E%3CP%3ENice%20article.%3C%2FP%3E%3CP%3ECould%20you%20extend%20this%20to%20a%20scenario%20where%20you%20have%20both%20hybrid%20AD%20joined%20and%20cloud%20native%20enrolled%20devices%20in%20the%20same%20tenant%3F%3C%2FP%3E%3CP%3EAnd%20how%20this%20effect%20the%20co-management%20setup%20for%20the%20hydrid%20AD%20joined%20devices%3F%3C%2FP%3E%3CP%3EHow%20would%20you%20make%20the%20distinction%20between%20both%20types%20when%20building%20the%20dynamic%20groups%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132479%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132479%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20Sharing%20with%20the%20Community%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Fhtml%2Fimages%2Femoticons%2Fcool_40x40.gif%22%20alt%3D%22%3Acool%3A%22%20title%3D%22%3Acool%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132644%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132644%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F155477%22%20target%3D%22_blank%22%3E%40Matthias%20Vandenberghe%3C%2FA%3E%20Very%20valid%20point%20here.%20We%20are%20currently%20testing%20best%20practice%20to%20compine%20hybrid%20Autopilot%20and%20co-management.%20Once%20we%20come%20up%20with%20our%20testing%20results%2C%20it%20will%20be%20shared%20either%20in%20this%20blog%20or%20in%20our%20official%20docs.%20Will%20keep%20you%20guys%20posted.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132686%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132686%22%20slang%3D%22en-US%22%3E%3CP%3EFantastic%20work%2C%20thank%20you%20for%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132696%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132696%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295191%22%20target%3D%22_blank%22%3E%40Mingzhe_Li%3C%2FA%3E%26nbsp%3B%2C%20thanks.%3C%2FP%3E%3CP%3ECurrently%20we%20are%20also%20testing%20this%20and%20ran%20already%20in%20some%20problems.%20Like%20we%20have%20several%20types%20of%20devices%2C%20ones%20only%20joined%20via%20intune%20and%20already%20installed%20with%20autopilot%2C%20and%20then%20we%20have%20Hybrid%20ad%20joined%20devices.%3C%2FP%3E%3CP%3EWhen%20enabling%20co-management%2C%20without%20shifting%20workloads%20yet%2C%20we%20see%20some%20strange%20effect%20like%20the%20ESP%20presenting...%20even-though%20we%20are%20not%20launching%20the%20autopilot%20process....%20so%20the%20ESP%20shouldn't%20even%20be%20shown%20as%20the%20device%20is%20already%20joined%2C%20installed%20and%20managed...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETherefor%2C%20it%20would%20be%20nice%20to%20indeed%20see%20some%20best%20practices%20on%20this%20topic%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1136692%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1136692%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20for%20sharing%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132761%22%20slang%3D%22en-US%22%3ERe%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%E2%80%93%20Admins%20Experience%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132761%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20still%20stuck%20on%20the%20provisioning.%20Also%20I%20dont%20know%20where%20to%20find%20the%20diagnostics%20data%2C%20because%20there%20is%20a%20%22View%20diagnostics%20data%22%20button%20but%20no%20data%20in%20the%20folder.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUpdate%3A%20Problem%20solved-%20there%20was%20still%20the%20legacy%20intune%20enrollment%20application%20registered.%20After%20removal%20it%20worked.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1131428%22%20slang%3D%22en-US%22%3EAdmins%20Experience%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1131428%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20everyone%2C%20today%20we%20have%20a%20post%20by%20Intune%20Support%20Engineer%26nbsp%3BMingzhe%20Li.%20In%20this%20post%2C%20Mingzhe%20takes%20a%20look%20at%20Deploying%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20from%20an%20Admins%20perspective.%20This%20is%20a%20must-read%20if%20you%E2%80%99re%20planning%20to%20implement%20this%20feature.%26nbsp%3B%20This%20is%20a%20two%20part%20series%2C%20see%20the%20End-User%20Experience%20below%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fintune-customer-success%2Fend-user-experience-deploy-hybrid-azure-ad-joined-devices-by%2Fba-p%2F1133748%22%20target%3D%22_blank%22%3EEnd-User%20Experience%3A%20Deploy%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%20%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3D%3D%3D%3D%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20purpose%20of%20this%20post%20is%20to%20provide%20an%20easy%2C%20end-to-end%20guide%20on%20setting%20up%20hybrid%20Azure%20AD%20joined%20devices%20using%20Windows%20Autopilot%20with%20Microsoft%20Intune.%20When%20working%20on%20this%20topic%20as%20a%20Support%20Engineer%2C%20many%20customers%20ask%20me%20for%20a%20simple%20tutorial%20with%20as%20many%20screenshots%20as%20possible.%20Furthermore%2C%20my%20customers%20would%20like%20to%20know%20more%20about%20the%20technical%20workflow%20of%20the%20enrollment%20process%20and%20what%20log%20files%20to%20investigate.%20In%20response%20to%20that%2C%20I%20decided%20to%20write%20this%20article%20with%20the%20hopes%20that%20it%20will%20help%20you%20too%20and%20make%20getting%20this%20setup%20as%20easy%20as%20possible.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20article%20will%20describe%20how%20to%20set%20up%20the%20enrollment%20infrastructure%20e.g.%20how%20to%20install%20the%20Intune%20Connector%20for%20Active%20Directory%2C%20how%20to%20set%20the%20correct%20permissions%20on%20Active%20Directory%20and%20how%20to%20upload%20devices%20into%20the%20Intune%20Autopilot%20Portal%20etc.%20The%20audience%20of%20this%20article%20will%20be%20for%20IT%20admins.%20There%20is%20a%20separate%20article%20describing%20the%20end-user%20experience.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESetting%20up%20the%20infrastructure%3C%2FP%3E%3CP%3EBefore%20we%20start%20with%20setting%20up%20the%20infrastructure%2C%20make%20sure%20that%20we%20are%20meeting%20all%20the%20pre-requisites%20which%20are%20described%20here%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fenrollment%2Fwindows-autopilot-hybrid%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fenrollment%2Fwindows-autopilot-hybrid%3C%2FA%3E%3C%2FP%3E%3CP%3EOnce%20you%20confirmed%20that%20your%20landscape%20fulfills%20the%20pre-requirements%20according%20to%20above%20article%2C%20we%20need%20to%20activate%20the%20Auto%20MDM%20enrollment%20in%20Active%20Azure%20Directory.%3C%2FP%3E%3CP%3EActivate%20Auto%20MDM%20enrollment%3C%2FP%3E%3CP%3EMake%20sure%20that%20Auto-enrollment%20is%20activated%20for%20those%20users%20who%20are%20going%20to%20enroll%20their%20devices.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%2C%20we%20shall%20install%20the%20Intune%20Connector%20for%20Active%20Directory.%20The%20main%20responsibility%20of%20the%20connector%20is%20to%20automatically%20join%20the%20device%20into%20the%20on-premise%20Active%20Directory%20domain%20during%20the%20enrollment.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EInstall%20Hybrid%20Autopilot%20connector%3C%2FP%3E%3CP%3ELogon%20to%20your%20Intune%20portal%20and%20navigate%20to%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdd%20a%20new%20connector%2C%20download%20and%20install%20the%20connector%20on%20a%20Windows%202016%20server%20or%20higher%20which%20is%20managed%20by%20your%20Active%20Directory%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3EStart%20the%20installation%20of%20the%20downloaded%20file%20ODJConnectorBootstrapper.%20For%20troubleshooting%20the%20installation%2C%20we%20can%20check%20the%20event%20viewer%20logs%20Windows%20logs%20-%26gt%3B%20Application%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20the%20installation%20finished%2C%20click%20on%20%E2%80%98Configure%20now%E2%80%99%20and%20sign-in%20with%20Global%20Admin%20account%20or%20Intune%20Admin%20account.%20The%20account%20also%20must%20have%20a%20valid%20Intune%20license.%20This%20will%20make%20sure%20that%20the%20connector%20is%20properly%20managed%20by%20your%20Intune%20tenant.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnce%20the%20sign-in%20is%20completed%2C%20the%20connector%20should%20come-up%20on%20your%20Intune%20portal%20after%20a%20couple%20of%20minutes%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20are%20unable%20to%20sign-in%2C%20you%20can%20turn%20off%20IE%20Enhanced%20Security%20Configuration.%20If%20you%20have%20a%20web-proxy%2C%20make%20sure%20the%20proxy%20is%20bypassed%20according%20to%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fenrollment%2Fautopilot-hybrid-connector-proxy%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fenrollment%2Fautopilot-hybrid-connector-proxy%3C%2FA%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EConfigure%20your%20Active%20Directory%3C%2FP%3E%3CP%3ENow%2C%20we%20must%20make%20sure%20that%20the%20machine%20on%20which%20the%20Intune%20connector%20is%20installed%2C%20can%20create%20computer%20objects%20in%20the%20Active%20Directory.%20Logon%20to%20your%20Domain%20Controller%20and%20run%20DSA.msc.%20Create%20a%20new%20OU%20which%20includes%20all%20hybrid-joined%20devices%20using%20Windows%20Autopilot%20and%20click%20on%20%E2%80%98delegate%20control%E2%80%99%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EClick%20on%20%E2%80%98Add%E2%80%99%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdd%20Computers%20to%20Object%20Types%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20enter%20the%20name%20of%20the%20Server%20where%20the%20connector%20is%20installed%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFollow%20the%20instructions%20and%20select%20Create%20a%20custom%20tasks%20to%20delegate%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EConfigure%20according%20to%20below%20settings%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFinish%20the%20configuration.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECreate%20device%20group%20on%20Intune%20portal%3C%2FP%3E%3CP%3ELogon%20to%20your%20Intune%20portal%20and%20create%20a%20new%20dynamic%20device%20group%20(in%20our%20example%20Autopilot_Test)%20on%20the%20Intune%20portal%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3EThe%20membership%20rule%20should%20be%3A%3C%2FP%3E%3CP%3Edevice.devicePhysicalIDs%20-any%20_%20-contains%20%22%5BZTDId%5D%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20group%20will%20include%20all%20devices%20uploaded%20into%20the%20Intune%20Autopilot%20portal%20so%20that%20we%20can%20deploy%20the%20Autopilot%20enrollment%20profile%20and%20the%20domain%20join%20profile%20at%20a%20later%20point%20in%20time.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUpload%20your%20devices%20to%20the%20Intune%20Autopilot%20portal%3C%2FP%3E%3CP%3EAfter%20we%20have%20created%20the%20device%20group%2C%20we%20need%20to%20obtain%20the%20hardware%20hash%20from%20the%20device%20to%20be%20enrolled.%20The%20hardware%20hash%20will%20usually%20be%20provided%20by%20the%20hardware%20vendor.%20Alternatively%2C%20you%20can%20also%20run%20below%20Powershell%20commands%20on%20the%20device.%20A%20csv%20file%20will%20be%20created%20and%20stored%20into%20the%20directory%20C%3A%5CHWID.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Emd%20c%3A%5C%5CHWID%3C%2FP%3E%3CP%3ESet-Location%26nbsp%3B%20c%3A%5C%5CHWID%3C%2FP%3E%3CP%3ESet-ExecutionPolicy%26nbsp%3B%20-Scope%26nbsp%3B%20Process%26nbsp%3B%20-ExecutionPolicy%26nbsp%3B%20Unrestricted%3C%2FP%3E%3CP%3EInstall-Script%26nbsp%3B%20-Name%26nbsp%3B%20Get-WindowsAutoPilotInfo%3C%2FP%3E%3CP%3EGet-WindowsAutoPilotInfo.ps1%26nbsp%3B%20-OutputFile%26nbsp%3B%20AutoPilotHWID.csv%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EImport%20the%20csv%20file%20to%20the%20Intune%20Autopilot%20portal%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20import%20can%20take%20up%20to%2015%20minutes.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnce%20the%20device%20is%20successfully%20synched%2C%20a%20new%20entry%20will%20come%20up%20in%20the%20portal%3A%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20device%20entry%20should%20also%20come-up%20in%20Azure%20AD%3A%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20device%20group%20we%20previously%20created%20will%20be%20populated%20automatically%20with%20the%20synched%20devices%3A%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20case%20the%20device%20appears%20in%20the%20Intune%20Autopilot%20portal%20after%20synching%20but%20not%20in%20the%20Azure%20AD%20device%20list%2C%20make%20sure%20that%20the%20same%20device%20is%20not%20already%20registered%2Fjoined%20within%20the%20current%20Azure%20AD%20tenant%20or%20within%20any%20other%20Azure%20AD%20tenants.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECreate%20Autopilot%20profile%3C%2FP%3E%3CP%3EOnce%20we%20have%20confirmed%20that%20the%20device%20group%20is%20successfully%20populated%20with%20the%20synched%20Autopilot%20devices%2C%20we%20can%20start%20to%20create%20the%20Autopilot%20enrollment%20profile%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%2C%20you%20can%20set%20settings%20as%20below%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDeploy%20the%20profile%20to%20the%20dynamic%20device%20group%20you%20created%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWait%20until%20the%20device%20appears%20under%20the%20enrollment%20profile%20so%20that%20we%20can%20confirm%20that%20the%20device%20is%20assigned%20to%20the%20profile%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20can%20take%20up%20to%2010%20minutes.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECreate%20domain%20join%20profile%3C%2FP%3E%3CP%3EAfterwards%2C%20we%20need%20to%20create%20the%20domain%20join%20profile%20and%20deploy%20it%20to%20our%20Autopilot%20devices.%20The%20domain%20join%20profile%20will%20include%20parameters%20such%20as%20your%20domain%20name%20and%20the%20definition%20of%20the%20OU%20you%20created%20for%20Autopilot%20devices.%20During%20the%20enrollment%20process%2C%20the%20information%20included%20in%20the%20domain%20join%20profile%20will%20be%20exported%20into%20a%20BLOB%20file%20and%20processed%20by%20the%20Intune%20connector.%20The%20Intune%20connector%20will%20add%20the%20device%20into%20the%20on-prem%20Active%20Directory%20domain%20based%20on%20the%20information%20stored%20in%20the%20BLOB%20file.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENavigate%20to%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFill%20the%20values%20with%20the%20required%20information%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EComputer%20name%20prefix%3A%20This%20parameter%20defines%20the%20prefix%20for%20each%20computer%20enrolled%20with%20Autopilot%20into%20Intune.%20If%20the%20prefix%20is%20set%20as%20Mingzhe-%2C%20the%20device%20would%20look%20as%20below%20once%20enrolled%20into%20Intune%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDomain%20name%3A%20Provide%20the%20full%20domain%20name%20here.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOrganizational%20unit%3A%20This%20should%20include%20the%20distinguished%20name%20of%20the%20Autopilot%20OU.%20In%20our%20example%2C%20we%20previously%20created%20the%20OU%20Hybrid_Autopilot.%20We%20can%20get%20the%20distinguished%20name%20of%20this%20OU%20here%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESave%20the%20profile%20and%20deploy%20it%20to%20your%20Autopilot%20device%20group%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EConfigure%20hybrid%20Azure%20Active%20Directory%20join%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20the%20device%20will%20be%20hybrid%20Azure%20Active%20Directory%20joined%20during%20the%20enrollment%2C%20we%20need%20to%20configure%20required%20settings%20on%20your%20Azure%20AD%20Connect%20server.%20A%20how-to%20guide%20can%20be%20found%20in%20below%20links%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20have%20a%20federated%20environment%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Fhybrid-azuread-join-federated-domains%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Fhybrid-azuread-join-federated-domains%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20have%20a%20managed%20environment%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Fhybrid-azuread-join-managed-domains%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Fhybrid-azuread-join-managed-domains%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20now%20completed%20all%20steps%20to%20enable%20the%20Windows%20Autopilot%20process%20on%20the%20target.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMingzhe%20Li%26nbsp%3B%3C%2FP%3E%3CP%3EIntune%20Support%20Engineer%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1131428%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERead%20this%20post%20for%20the%20Admin%20Experience%26nbsp%3BDeploying%20Hybrid%20Azure%20AD-joined%20devices%20by%20using%20Intune%20and%20Windows%20Autopilot%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E
Microsoft

Hi everyone, today we have a post by Intune Support Engineer Mingzhe Li. In this post, Mingzhe takes a look at Deploying Hybrid Azure AD-joined devices by using Intune and Windows Autopilot from an Admins perspective. This is a must-read if you’re planning to implement this feature.  This is a two part series, see the End-User Experience below:

 

End-User Experience: Deploy Hybrid Azure AD-joined devices by using Intune and Windows Autopilot  

=====

 

The purpose of this post is to provide an easy, end-to-end guide on setting up hybrid Azure AD joined devices using Windows Autopilot with Microsoft Intune. When working on this topic as a Support Engineer, many customers ask me for a simple tutorial with as many screenshots as possible. Furthermore, my customers would like to know more about the technical workflow of the enrollment process and what log files to investigate. In response to that, I decided to write this article with the hopes that it will help you too and make getting this setup as easy as possible.

 

This article will describe how to set up the enrollment infrastructure e.g. how to install the Intune Connector for Active Directory, how to set the correct permissions on Active Directory and how to upload devices into the Intune Autopilot Portal etc. The audience of this article will be for IT admins. There is a separate article describing the end-user experience.

 

Setting up the infrastructure

Before we start with setting up the infrastructure, make sure that we are meeting all the pre-requisites which are described here:

https://docs.microsoft.com/en-us/intune/enrollment/windows-autopilot-hybrid

Once you confirmed that your landscape fulfills the pre-requirements according to above article, we need to activate the Auto MDM enrollment in Active Azure Directory.

Activate Auto MDM enrollment

Make sure that Auto-enrollment is activated for those users who are going to enroll their devices.

 

HADJAuto1.png

 

Now, we shall install the Intune Connector for Active Directory. The main responsibility of the connector is to automatically join the device into the on-premise Active Directory domain during the enrollment.

 

Install Hybrid Autopilot connector

Logon to your Intune portal and navigate to:

 

HADJAuto2.png

 

Add a new connector, download and install the connector on a Windows 2016 server or higher which is managed by your Active Directory:

 

HADJAuto3.png

Start the installation of the downloaded file ODJConnectorBootstrapper. For troubleshooting the installation, we can check the event viewer logs Windows logs -> Application:

 

HADJAuto4.png

 

After the installation finished, click on ‘Configure now’ and sign-in with Global Admin account or Intune Admin account. The account also must have a valid Intune license. This will make sure that the connector is properly managed by your Intune tenant.

 

HADJAuto5.png

 

Once the sign-in is completed, the connector should come-up on your Intune portal after a couple of minutes:

 

HADJAuto6.png

 

If you are unable to sign-in, you can turn off IE Enhanced Security Configuration. If you have a web-proxy, make sure the proxy is bypassed according to https://docs.microsoft.com/en-us/intune/enrollment/autopilot-hybrid-connector-proxy.

 

Configure your Active Directory

Now, we must make sure that the machine on which the Intune connector is installed, can create computer objects in the Active Directory. Logon to your Domain Controller and run DSA.msc. Create a new OU which includes all hybrid-joined devices using Windows Autopilot and click on ‘delegate control’:

 

HADJAuto7.png

 

Click on ‘Add’:

 

HADJAuto8.png

 

Add Computers to Object Types:

 

HADJAuto9.pngHADJAuto10.png

 

Now enter the name of the Server where the connector is installed:

 

HADJAuto11.png

 

Follow the instructions and select Create a custom tasks to delegate:

 

HADJAuto12.png

 

Configure according to below settings:

 

HADJAuto13.png

 

HADJAuto14.png

 

 

Finish the configuration.

 

Create device group on Intune portal

Logon to your Intune portal and create a new dynamic device group (in our example Autopilot_Test) on the Intune portal:

 

 

 

HADJAuto15.png

The membership rule should be:

device.devicePhysicalIDs -any _ -contains "[ZTDId]"

 

 

This group will include all devices uploaded into the Intune Autopilot portal so that we can deploy the Autopilot enrollment profile and the domain join profile at a later point in time.

 

Upload your devices to the Intune Autopilot portal

After we have created the device group, we need to obtain the hardware hash from the device to be enrolled. The hardware hash will usually be provided by the hardware vendor. Alternatively, you can also run below Powershell commands on the device. A csv file will be created and stored into the directory C:\HWID.

 

md c:\\HWID

Set-Location  c:\\HWID

Set-ExecutionPolicy  -Scope  Process  -ExecutionPolicy  Unrestricted

Install-Script  -Name  Get-WindowsAutoPilotInfo

Get-WindowsAutoPilotInfo.ps1  -OutputFile  AutoPilotHWID.csv

 

Import the csv file to the Intune Autopilot portal:

 

HADJAuto16.png

 

HADJAuto17.png

 

The import can take up to 15 minutes.

 

 

Once the device is successfully synched, a new entry will come up in the portal:

HADJAuto18.png

 

This device entry should also come-up in Azure AD:

HADJAuto19.png

 

 

The device group we previously created will be populated automatically with the synched devices:

HADJAuto20.png

 

 

In case the device appears in the Intune Autopilot portal after synching but not in the Azure AD device list, make sure that the same device is not already registered/joined within the current Azure AD tenant or within any other Azure AD tenants.

 

 

Create Autopilot profile

Once we have confirmed that the device group is successfully populated with the synched Autopilot devices, we can start to create the Autopilot enrollment profile:

 

HADJAuto21.png

 

 

HADJAuto22.png

 

For example, you can set settings as below:

 

HADJAuto23.png

 

Deploy the profile to the dynamic device group you created:

 

HADJAuto24.png

 

 

Wait until the device appears under the enrollment profile so that we can confirm that the device is assigned to the profile:

 

HADJAuto25.png

 

This can take up to 10 minutes.

 

 

Create domain join profile

Afterwards, we need to create the domain join profile and deploy it to our Autopilot devices. The domain join profile will include parameters such as your domain name and the definition of the OU you created for Autopilot devices. During the enrollment process, the information included in the domain join profile will be exported into a BLOB file and processed by the Intune connector. The Intune connector will add the device into the on-prem Active Directory domain based on the information stored in the BLOB file.

 

 

Navigate to:

 

HADJAuto26.png

 

 

Fill the values with the required information:

 

HADJAuto27.png

 

 

Computer name prefix: This parameter defines the prefix for each computer enrolled with Autopilot into Intune. If the prefix is set as Mingzhe-, the device would look as below once enrolled into Intune:

 

HADJAuto28.png

 

 

Domain name: Provide the full domain name here.

 

Organizational unit: This should include the distinguished name of the Autopilot OU. In our example, we previously created the OU Hybrid_Autopilot. We can get the distinguished name of this OU here:

 

HADJAuto29.png

 

 

 

 

 

 

 

 

 

 

HADJAuto30.png

 

 

 

 

 

 

 

 

 

 

Save the profile and deploy it to your Autopilot device group:

 

HadJAuto31.png

 

Configure hybrid Azure Active Directory join

 

As the device will be hybrid Azure Active Directory joined during the enrollment, we need to configure required settings on your Azure AD Connect server. A how-to guide can be found in below links:

 

If you have a federated environment:

https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-federated-domain...

 

If you have a managed environment:

https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains

 

We have now completed all steps to enable the Windows Autopilot process on the target.

 

Mingzhe Li 

Intune Support Engineer

7 Comments

Nice article.

Could you extend this to a scenario where you have both hybrid AD joined and cloud native enrolled devices in the same tenant?

And how this effect the co-management setup for the hydrid AD joined devices?

How would you make the distinction between both types when building the dynamic groups?

 

Thanks for Sharing with the Community :cool:

Microsoft

@Matthias Vandenberghe Very valid point here. We are currently testing best practice to compine hybrid Autopilot and co-management. Once we come up with our testing results, it will be shared either in this blog or in our official docs. Will keep you guys posted.

Contributor

Fantastic work, thank you for this.

@Mingzhe_Li , thanks.

Currently we are also testing this and ran already in some problems. Like we have several types of devices, ones only joined via intune and already installed with autopilot, and then we have Hybrid ad joined devices.

When enabling co-management, without shifting workloads yet, we see some strange effect like the ESP presenting... even-though we are not launching the autopilot process.... so the ESP shouldn't even be shown as the device is already joined, installed and managed...

 

Therefor, it would be nice to indeed see some best practices on this topic

Contributor

I am still stuck on the provisioning. Also I dont know where to find the diagnostics data, because there is a "View diagnostics data" button but no data in the folder.

 

Update: Problem solved- there was still the legacy intune enrollment application registered. After removal it worked.

Visitor

Thank you for sharing