Feb 10 2020
- last edited on
Jan 14 2022
We want to migrate our On-Prem AD devices to Azure AD and enroll into intune. We have Azure AD sync and all but needs to convert machine to Azure AD join only not Hybrid AD. So we would like to create new user profile on machine.
We have used two methods so far.
1) Reset the machine and use join to Azure AD from OOBE. ( Issue - This will make user a Administrator for that machine and we dont want that )
2) Unbind from on-prem AD, join to Azure AD manually but the same issue like number 1.
3) Using Hardware Hash, register devices to Autopilot and then reset all the machines. ( Issue - This will take too long to migrate 250 machines and helping remote workers are quite difficult )
Has anyone tried any different method or is there any expert suggestion ?
Feb 11 2020 03:22 AM
Feb 11 2020 01:19 PM
May 19 2020 12:13 PM - edited May 19 2020 12:14 PM
My company is attempting almost the exact same situation.... for 1800 devices.
Please, if anyone has a comprehensive strategy for this solution I'd appreciate it greatly.
My understanding developed from the linked articles is the steps for accomplishing this would be to:
1. create an AutoPilot profile which either acknowledges a present local administrator account or creates it when the device hits Azure
2. create a Group which applies the required applications for my company
3. use the Bulk update to target my on-premises machines for moving to Azure (how do I make sure the devices i select for bulk autopilot are not flagged as "personal" in on-premises AD?)
4. Clear my on-premises record of devices after each device appears in Azure AD
5. Start a sync in Intune and allow it to push apps and add any missing administrator account based on the Group and Profile settings
Thank you for any clarifications available.
Jun 11 2020 11:56 AM
Jun 11 2020 11:36 PM
Jul 11 2020 01:11 AM
Oct 09 2020 07:11 AM
@AvinashG Hey Avinash,
We have found out a work around to this.
While the machine is joined to a local domain domain1.com
To be able to enroll it in Intune MDM (without joining the doamin AzureCloud.com doamin).
You first have to remove any management tools for example (SCCM Client). Once that client is removed, you should be able to Enroll in Mobile Device management from Settings -> Accounts -> Access work or school. Under related settings, you will get an option to enroll in MDM, once you do it, it should be easy after that.
Hope this helps.
Oct 09 2020 07:33 AM
This isn't the full awnser to the question. The question was how to get from an Domain joined setup to a native Azure AD joined setup for existing devices. The steps you described involve enrolling an Domain device to Azure AD. It doesn't remove the device from the on-prem domain.
Oct 09 2020 07:45 AM
Oct 14 2020 03:12 AM
In my opinion, when you would need to script this, the difficulty would lie in the removal of the PC from the current AD to a workgroup:
* This could be done by using the remove-computer cmdlet. (with or without reboot, to be tested)
After that step, inject a WDC package to get it into AzureAD:
If you had your indentities synced up with AD Connect, the SID would be the same as would the profile,....(also to be tested)
Interested to hear other solutions also
Nov 03 2020 03:09 PM
May 07 2021 02:46 AM - edited May 07 2021 02:47 AM
okay, a little bit late, but this results that users get a new profiles. And this action takes a very long time (about 3 hours while changing from local ad to azure ad). There is probably an very long error timeout.
That is not a top solution.
Researching for best practice. Perhaps with SCCM on prem support.
May 11 2021 12:32 AM
Our devices are currently Hybrid Azure AD Joined and I am considering moving new devices over to Azure AD joined to simplify enrolment to Windows Hello for Business and Autopilot.
The only downsides I could see is as follows:
No login scripts will run at sign in when connected to the LAN
No Group Policy control
No granular control regarding local admin rights to the local device (it is all or nothing)
Just wondering if anyone has found any other disadvantages/benefits and what motivated you to consider making the change over to Azure AD Joined?
May 14 2021 11:44 AM
@Chris Yue With workforce scattered everywhere using on-prem creds is a challenge. I am a fan of using MECM to enable comanagement and then at the next cycle redeploy the machines with AzureAD only using an autopilot Json file during OOBE to lock in the domain and make sure it is setup for MDM. I have found replacements within Intune for most GPO functions and not getting constantly hung up in whether they are doing sync or async processing simplifies things, especially with them not being on-prem much at the moment.
Aug 11 2021 05:35 AM
@0--O1 There is a Microsoft article on this. When you unjoin a computer from an AD Domain and move it to a workgroup, Windows will use the domain name as the workgroup name. Then when you try to Azure AD Join the computer, the computer will start looking for the AD domain. It will stop looking in 3 hours (times-out). To work around this, when you unjoin the computer from AD, change the workgroup name to anything else that is not the name of the AD (e.g., change it to Workgroup). Then when you Azure AD Join the computer, it happens in real time.
Jan 19 2022 07:46 PM