Forum Discussion

Joe Stocker's avatar
Joe Stocker
Bronze Contributor
Jul 18, 2017

Azure AD Conditional Access - Require Domain Joined Device

Does the ‘Domain Join’ checkbox in Azure AD Conditional Access require Azure AD Domain join, or does it mean on-premises Domain Join? The attached screen shot says ‘Not Azure AD Domain Join’ but the ...
Access Management
Azure Active Directory (AAD)
Identity Management
  • Loryan Strant's avatar
    Loryan Strant
    Jul 18, 2017
    Correct, that would be on-prem AD domain-join.
    Why it's confusing is because it's possible to have on-prem AD domain-joined PCs automatically register and enroll with Azure AD.
Loryan Strant's avatar
Loryan Strant
MVP
Jul 18, 2017
Correct, that would be on-prem AD domain-join.
Why it's confusing is because it's possible to have on-prem AD domain-joined PCs automatically register and enroll with Azure AD.
  • Joe Stocker's avatar
    Joe Stocker
    Bronze Contributor
    Jul 18, 2017
    So if a machine is not joined to on-prem AD and it is only joined to Azure AD, you're saying conditional access won't work? Why doesn't the documentation list the requirement of being on-prem AD joined?
    • Bill Hughes's avatar
      Bill Hughes
      Copper Contributor
      Jul 18, 2017

      An Azure AD joined machines will work with conditional access. You will just need to use the value of "Require device to be marked as compliant" This requires the device to be managed through Intune however and does not allow you to use only Azure AD joined machines that are not managed.

      • Vineet Arora's avatar
        Vineet Arora
        Brass Contributor
        Oct 06, 2017

        Hi,

         

        Can you please elaborate further.

         

        We have following requirement.

        Only the devices issued by IT departmernt should be able to access SharePoint Online. How can I acheive this using conditional or compliance policies?

         

        We don't have on prem AD.

         

        Thanks,

Resources