Issues with Hybrid Azure AD Join During Autopilot Enrollment
Hello Community, I am seeking advice on an issue we’re experiencing with Microsoft Intune and Autopilot in our environment. We have set up an enrollment profile intended to enroll devices as Hybrid Azure AD joined during the Autopilot process. However, we’re encountering a problem where some devices are enrolling as Azure AD joined (cloud-only) instead of Hybrid. Has anyone else experienced this issue? Any suggestions on what might be causing this inconsistency or how to troubleshoot it further would be greatly appreciated!
Windows Servers AAD Hybrid Joined and SCCM ConfigMgr Co-Management MDM Auto-Enrollment
I have doubts about some configurations. Basically, we have: sccm installation with co-management performed via cloud-attach wizard intune pilot group device collection configured default client setting policy allows device registration in azure ad azure ad connect configured for hybrid join mdm user scope configured to all in azure ad mam user scope configured to none users can register devices in azure ad (Users may join devices to Azure AD) business premium licenses usage location configured in the azure ad synced user no conditional access or mfa configured The situation is that both client and server are synchronized in azure ad and are seen as join type "hybrid azure ad joined". In azure ad the clients has as mdm "microsoft configuration manager", the same clients then on intune in the managed column by show "co-managed". Servers on the other hand (windows 2016) are not automatically enrolled in intune and i don't understand why, the are hybrid azure ad joined in azure ad as devices. Other unclear thing, do i have to create the gpo for automatic enrollment in active directory (enable automatic mdm enrollment using default azure ad credentials)? At the moment it is created and linked to the OU containing servers and set as "device credential" (i read in documentation that with sccm or azure virtual desktop it is supported), even if i set in "user credential" anyway it doesn't work. With the gpo applied the scheduled task is created but in the events I get the following error: Auto MDM Enroll: Device Credential (0x1), Failed (Unknown Win32 Error code: 0x8018001c) By doing a dsregcmd /status on the machine everything seems ok. I don't understand what the best practices are regarding this gpo, and where I am going wrong.Onedrive silent sign in
Hello friends! I've simulate in my lab environment an hybrid Azure AD environment containing a domain controler, a separate server with Azure AD Connect 2.1.16.0 and two test machines. AD Connect is configured with Hybrid Join, Password Hash Synchronization and SSO enabled. My test machines appear in Azure AD as hybrid joined whthout assigned owner,but this seems to be the correct behaviour. Following several guides like https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fonedrive%2Fuse-silent-account-configuration&data=05%7C01%7Crvaldovinos%40cistec.es%7Cdafb4552ede347b44c1a08da9fcd00c6%7Cfd106bedc25344e39ac2a7fa5e26eff6%7C0%7C0%7C637998000075214257%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=zil1y6HDLgH0YfSDQ8IgvWx8c%2FD9ttjNcx%2BRS%2Fg6kHY%3D&reserved=0 https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fonedrive%2Fuse-group-policy&data=05%7C01%7Crvaldovinos%40cistec.es%7C205c7fa0f66449de483c08daa07a457c%7Cfd106bedc25344e39ac2a7fa5e26eff6%7C0%7C0%7C637998744256696680%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=u%2B8COf5Cp%2ByNnGfnnXCvGHs4KM1x5u0bITkWeJq6XAw%3D&reserved=0 or https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.adamfowlerit.com%2F2018%2F02%2Fonedrive-business-auto-sign-windows-10%2F&data=05%7C01%7Crvaldovinos%40cistec.es%7C5d891d1fac9b45ff4c7a08daa08a074f%7Cfd106bedc25344e39ac2a7fa5e26eff6%7C0%7C0%7C637998811933674074%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=UAFPJBDzOjuMqBRKokdMfUs2fsta9lXC4NionoBUhYY%3D&reserved=0 I´ve configure Onedrive silent configuration but it doesn´t work. When the user signs in the ondrive sync client looks for updates and after that it doesn´t do anything more, it just shows the message "Not signed in". I´ve applied the script mentioned in this article on an AD Joined machine and it works perfectly https://learn.microsoft.com/en-us/onedrive/use-silent-account-configuration but on my hybrid joined machines with the GPOs nothing happens, it seems like the silent config process doesn´t even start . My GPOs enable the "Silent move Windos Knowb folders to Onedrive" and the "Silently sign in users to their Onedrive Sync app with their windows crdentials" and also add "https://autologon.microsoftazuread-sso.com" and "https://aadg.windows.net.nsatc.net" to the local intranet sites. Someone has experienced such a behaviour? I´m missing something important not mentioned in the guides? Any help will be appreciated Thank you in advanced