Windows 10: Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Jina95 · Jun 20, 2022

I've got a few device with a weird issue where it's perfectly Hybrid Azure AD Join but inside Work or School Account > Info didn't show Managed by any organization and the last sync date.Our environment enables co-management so all devices must be Hybrid Azure AD Join and co-managed.Please help to advise if anyone encounters this issue. Rejoin on-premise domain, re-enroll to Azure AD and reinstall the MECM client didn't work.

:)

Brink · Jun 20, 2022

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@User) View on Twiiter

Brink · Jun 20, 2022

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

mlynch1958 · Jun 20, 2022

Join Azure Ad or Local domain

We have recently migrated to Office 365 with a hybrid AD setup. I am setting up a new laptop for a user, first one since the migration, and in the original setup it had me join the Azure AD. However, I usually set these laptops up to join the local domain so the users can access the file shares. The shares are accessed via Mapped Drives from Group Policy, and being joined to the Azure AD did not map these drives. When I go to join the laptop to the local domain, I get an error saying "The device is joined to an Azure AD. To join an Active Directory domain, you must .... disconnect your device from your work or school."
So there's no way to be joined to the Azure, even though its syncing with my local AD? I want the best of both worlds. What's the best way of doing that? I feel if I unjoin from the Azure AD I'm kind of going backwards, but they need access to those local file stores. Any brilliant workarounds out there?
Thanks!

Windows 10: Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage - Similar Threads - Hybrid Azure Join

Enabled MFA for "Run as Administrator" on Azure AD Joined Win11 Devices

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

Anyone ever seen a Hybrid Join Co-managed device config like this?

Anyone ever seen a Hybrid Join Co-managed device config like this?

Anyone ever seen a Hybrid Join Co-managed device config like this?

Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Windows Autopilot for existing devices supports Hybrid Azure AD Join