Controlled validation of hybrid Azure AD join

[Stuart King]

Hi All

Not sure if this should be here or in the Azure AD section.

I'm looking to implement a Controlled validation of Hybrid Azure AD Join / Auto enrollment in Intune via GPO, using the MS guide below as a reference:

https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-control

My questions are:

• Do I set the GPO to my test deployment OU
• Do I simply remove the GPO from my test deployment OU on successful testing

Would like to hear from anyone who has implemented this

Regards

[#2]

From my experience, I just create registry keys and assign them to the devices.

If you are done testing, would you like to remove these devices from AAD/Intune or add all devices to AAD?

[#3]

@Thijs Lecomte 

Hi Buddy

What I would like to do is:

• Hybrid Azure AD Join my devices in my TEST / PILOT / UAT group only
• Once successful
• Apply to the whole on-premise AD domain / devices

Regards

[#4]

@Stuart King 

This is the way I do it:

- Create GPO with registry edits and apply to test OU

- If succesfull, delete GPO

- Assign domain wide policy through AAD connect (https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains)

BTW: best make sure all the computers are W10 1803 in order to avoid dual state (https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan#review-cont...)

[#5]

@Thijs Lecomte 

Hi Buddy

So the process would be:

• Controlled Hybrid Azure AD Join on Test OU
• Then once successful
• Configure AADC

In essence, DO NOT TOUCH AADC until Controlled Hybrid Azure AD Join is verified OK?

Regards

[#6]

@Stuart King that's correct :)

let me know how it goes!

[#7]

@Thijs Lecomte 

Sorry, I did mention before about applying the Controlled Hybrid GPO to the test OU BEFORE touching AADC, but I assume the TEST OU must be included in the AADC sync with the syncing of devices as per below?

[#8]

Yes, the OU needs to be sync'ed

This doesn't enable Hybrid join by itself

[#9]

@Thijs Lecomte 

Do the devices need to be in a group or is the OU sufficient for the Controlled Hybrid test?

Regards

[#10]

Dependant on how you configure the GPO
If you put the GPO on a OU, than a OU is sufficient

[#11]

@Thijs Lecomte 

Excellent thanks, testing now.

[#12]

@Thijs Lecomte 

Applied GPO to OU and OU to sync, still no device in AAD.

Am I missing something?

[#13]

@Stuart King 

Could you troubleshoot it using this article? https://365bythijs.be/2019/11/02/troubleshooting-hybrid-azure-ad-join/