Forum Discussion
Hybrid AAD Join with non-routable UPNs on onpremise AD
Moe_KinaniHi Moe, thanks for reply.
This requirement is met, domain on AAD is configured properly (all green). The user name on AAD includes the verified domain BUT on AD the UPN doesn't include a routable domain. The AD Connect synchronizes the identities. All this works well. Only MDM enrollment doesn't happen.
If xyz.com is verified domain->The synced user needs to be user@xyz.com, primary upn NOT alias.
Moe
Moe_Kinani i can confirm that the only solution is to change all the on prem AD UPN's to a routable domain.
- Thanks, Th ms Vrhydn, when two guys are saying the same it must be truth!
Red Flag
I know it is too late for your query (approx. 3 months late), but for future researchers:
It is possible to achieve Hybrid Join with non-routable UPN, as long as you can deploy ADFS as your authentiation method.
Source (look at the table on the end of this link): https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan
Regards,
Rodrigo Dias
- Thanks, Moe, for clarification. The docs are not clear enough - as devices are going to the hybrid state but MDM enrollment will not happen. Thanks again!
