It is good to reassess your approach to things to see if it still makes sense. About four years ago a tech coworker developed our standard configuration for Azure AD Connect. At that time we were not using Intune (if it was even around). It involved performing an express installation but prior to performing the initial sync modifying the Synchronization Service Manager to only sync specific OUs to Azure AD. Typically these OUs had users, contacts, and distribution lists we wanted to use in Azure AD. There were some benefits to this approach.
First, in Azure AD you only saw users, contacts, and groups that you intentionally synced and wanted to use there. It avoided the clutter of default groups like DHCP Administrators, former employees who have had their AD DS accounts disabled but not yet deleted, and so forth. Second, if you had a situation where you no longer needed to retain a former employee's Azure AD user and related content you could unassign the license from the user in Microsoft 365 admin center and then in AD DS move the user account to an OU not synced with Azure AD.
Is this approach still a good approach? I did some reading and thinking and I suspect it is not in certain situations. I suspect choosing the sync the entire AD DS domain, or at least including the OUs with computer objects, is a better approach. First, this assumes that the users in the tenant have a license for Intune. If they do then we could use a Group Policy Object to Hybrid Azure AD join the devices in Intune. At that point we would be able to apply all the Mobile Device Management policies we do to Azure AD joined Windows 10 computers. Second, if the client had OSes older than Windows 10 Hybrid Azure AD join allows us to enroll and manage those in Intune as well, though this may lead to creating additional Compliance Policies and Configuration Profiles as they are broken down by Windows OS version. Though, if the user has a Microsoft 365 Business Premium license we could consider upgrading to Windows 10 Pro and from there the edition will automatically change to Windows 10 Business.
On the other side, there have been a couple of clients where we setup Azure AD Connect. We eventually got to a place where we could retire all their on-premise Windows Servers which includes AD DS and transition to a pure Azure AD environment. Would having the Windows 10 computers Hybrid Azure AD joined complicate this transition? We'd probably use a third party tool to migrate the Windows 10 computer and Windows user profile from AD DS to Azure AD so this may be a moot point.
Are there any other caveats or issues? Should we start syncing the AD DS computer objects at the minimum to Azure AD as well?
Matthew
