Windows 10: Device shows in Intune as Azure AD Joined but MDM is NONE

SebZ601 · Sep 13, 2022

As in the subject. How can I add it back so it's managed by Intune?We only have Azure AD.

:)

john zuh · Sep 13, 2022

Unable to enroll Device into Azure AD using 3rd Party On-Premise MDM

We are in the process of Integrating a third party MDM (on-premise) with Autopilot in AAD portal to enable Windows 10 OOBE. We want to achieve this by leveraging an on-premise Core Enterprise Application server in Azure. We have configured the following so far which is not working as expected. Also Can't find any relevant event logs within "User Device Registration" or "DeviceManagement-Enterprise-Diagnostics-Provider" :

The Autopilot Device Profile was created by importing ID into Autpilot.

Security Group with authorised users incl. MFA enabled Authentication

Redirect URIs was also configured in MDM App used by Azure AD to join Web App via corresponding client_id which maps one of Azure DRS.

Terms of Usage URLs plus secret keys was also created. MDM DISCOVERY URL & MDM TERMS OF USE URL are correctly set but havent checked if they are accessible over the Internet

NB: All of the above and a host of other requirements was double checked and tested several times. Device is able to enrol when InTune is used as the MDM server (by adding the InTune application to my Azure AD)

A Test Device out of the box was used to run the following test scenarios in Azure with an E5 incl. mdm + security subscription.

During our tests we got the following error:

****> we are not able to enroll Azure AD due to : Redirect UI
> [https://login.microsoftonline.com/WebApp/CloudDomainJoin/10] is not
> formed correctly****
Click to expand...

After some googling i read this could be caused by DNS issues, outbound proxy issues, or a variety of other reasons.

I also read this can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. We might have sent the authentication request to the wrong tenant but checked this with a colleague today and granted all necessary permissions as required. Didnt do the trick

I also read this could simply be due to a general Authentification Failure which still looks very generic to me.

Anyone has any clues on how to troubleshoot these kinds of problems based on the error reported. Tips Will be very much appreciated.

Brink · Sep 13, 2022

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@User) View on Twiiter

Brink · Sep 13, 2022

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

Windows 10: Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE - Similar Threads - Device shows Intune

No bitlocker key found on this device Intune and Azure AD

No bitlocker key found on this device Intune and Azure AD

Intune Hybrid Join, MDM „None"by AD Devices but by AAD Devies „Intune"

Intune Hybrid Join, MDM „None"by AD Devices but by AAD Devies „Intune"

Intune Hybrid Join, MDM „None"by AD Devices but by AAD Devies „Intune"

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

Microsoft intune and azure AD

Dis-Join Azure AD