AutoPilot Hybrid Join with White Glove - Issue at first login (MFA we think)

[Adam Weldon-Ming]

Hello, 

Project: Configure Auto-Pilot Hybrid Join for new users and laptops (with White Glove from Dell)

Process works and pre-provisioning is successful, a VPN (Cisco AnyConnect) that auto-starts at the login screen via a certificate.

At this stage the user is being targeted with Azure MFA via Conditional Access  

Once the user logs in, non of the Microsoft Endpoint Manager policies get picked up, Teams does not Automatically sign in (But prompts the user to sign in) 

If we leave it 30 mins (Waiting for Azure AD Connect to Sync the device. We reboot and we get the same, none of the policies get picked up, bit locker does not encrypt, teams doesn't auto sign in etc. 

If we do a dsregcmd /status on a CMD window, it shows as Domain Joined but not Azure AD joined. 

Then we look inside of "Work and School Account" we see the info button, we click this, and under "Sync" button has an error, with something on the lines of "Cannot authenticate your credentials" etc etc.  - I then click sync and it pops up with the Microsoft Loin Box, I select my account (connected to windows) and sign in - it then throws an MFA prompt to MS Authenticator.  If I approve, it syncs and the device starts to get all the policies it requires.  

=============

So, I decided to do another test, this time excluding the user from Azure MFA (CA Policy) and ran a new deployment.  

- Pre-provisions OK 

- Can login with AD credentials at login 

- Teams automatically signs in 

- dsregcmd /status shows everything is correct, it is Azure AD Joined and Local AD Joined

- wait 30 min for Hybrid AD Join to happen from the DC through AD Connect sync

- Reboot the machine, at next login, everything works, bit locker encrypts, oneDrive auto-signs in. 

- The world is a good place. 

It would therefore lead me to believe that with MFA enabled on the user that is signing into the machine, it blocks the initial Azure AD join process tied to that user and stops policies from pulling down to the machine. 

However, I cannot find any reference material surrounding MFA being the catalyst as to why the Hybrid Azure AD Join over VPN just does not work properly. Or how we can bypass it on AutoPilot deployments 'Hybrid' deployments. 

Note: In Azure AD > Devices > Device Settings - the option for "Devices to be Azure AD joined or Azure AD registered require Multi-Factor Authentication" is set to NO (Thought worth a mention, even though I think it does not apply to Hybrid AD join devices)

Another note, is if the user is enabled for MFA and we then deploy inside the corp network (which is bypassing/excluded from MFA) then this works without a problem too.   

The CA Policy for MFA targets All Cloud Apps.  We even tried to exclude "Intune Enrollment / Intune / Azure Management" - without success. 

So we're super stumped as what to do - Does anyone have any info on MFA being a problem with AutoPilot Hybrid Join over VPN?

[#2]

Isn't this an Azure Community discussion?
Not that I'm having great vibes from this techcommunity thing anyway :)

[#3]

@Cibavision No - It has every thing to do with Windows 10 deployment. 

[#4]

Well, as I said I mostly wanted to check if anybody actually check these forums and who is actually active.
Hard to tell if you should have post here or on a more specific Azure section. I don't see a lot of feedback or participation considering this should be the official Microsoft Techcommunity :)

[#5]

Morning Adam,

I am in a similar configuration so to speak hybrid join/MFA and CA and using anyconnect - but MFA has never been an issue. and we have devices require MFA set to yes and this is something you want as well.
I am struggling as well with applying policies :) so far i am unsuccesfull at having them applied at first logon - always requiring a reboot to see them applied whether policies are coming from MDM or GPO.

Do you have the privilege to run Start-ADSyncSyncCycle -PolicyType delta on your AD connect box ?
Do you have ESP user disabled ?
You could run a user-driven autopilot install - run a delta sync after the machine rebooted after ODJ ( expedite the HAADJ ) - and observe behavior you have .

I dont see as well much activity on autopilot subject or i am looking on wrong forums ...

Maya

[#6]

@MayaK06 

Hi Maya,

Thanks for your response - I too think maybe AutoPilot is being asked in other forums too, as Cibavision says - no one posts in here :)

However, to answer your question - we now have this working, we had to create a explicit CA rule that targets AutoPilot devices that granted access to the App "Intune Enrollment" and "Intune" for Hybrid AD Joined Devices.

Now when we do AutoPilot hybrid AD Join enrolment (outside of the corporate network, i.e. from home) we don't have a problem with MFA for the device. Users still require MFA to log into Teams etc for the first time but the device joins OK.

We still have the issue (but I think this can't be avoided) where you need to reboot the laptop after some time of joining it (usually around 30mins) and after we reboot it, it gets all the policies from MDM and GPO.

This is the rule we used:

Assignment - Specific user or group

Cloud App - Include: Intune & Intune Enrolment. Exclude: None

Condition - Device Platform: Windows

Access Controls - Grant & Require Hybrid Azure AD Joined device