AutoPilot Azure Hybrid Join

Question

AutoPilot Azure Hybrid Join

berketjune2012 376

Hi

I have a requirement where brand new laptops are automatically joined to the domain using autopilot. My question is around getting the machine joined to local ad without the use of vpn, if the user is outside the company network.

I wanted to confirm my understanding on this.

From what I read, the workstation can join Azure AAD over the internet (without vpn) and then with device writeback, be visible in local ad as a machine. This process can be done using the Intune connector without the use of VPN or network connectivity with the local domain controller

Can someone confirm if my understanding is correct?

If yes, can you then apply GPO to this machine that is written back to AD?

Thanks

Accepted answer

1 additional answer

Your answer

Answer 1

Jason Sandys 31,411 Microsoft Employee Moderator

Kind of on the document: see https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/planning-for-cloud-native-windows-endpoints-and-modern/ba-p/2834249 and https://techcommunity.microsoft.com/t5/intune-customer-success/success-with-remote-windows-autopilot-and-hybrid-azure-active/ba-p/2749353. We have some more formal documentation in the final phases of coordination right now.

As for initiating the VPN, there are two ways to do this: an auto-connecting VPN or a user-initiated VPN. Either way, the VPN client must be deployed during the device phase of Autopilot. The second link above discussed this briefly and includes links to the relevant documentation. Exact details for each VPN client though are up to the VPN vendor.

berketjune2012 376 Reputation points

2022-03-16T14:41:00.207+00:00

Thanks @Jason Sandys

By using AADJ this will not effect user login correct? In other words users can still user AD accounts to login to their machines as long as they are sycned to the cloud?
Jason Sandys 31,411 Reputation points Microsoft Employee Moderator

2022-03-16T14:57:50.32+00:00

Kind of. Technically, it is a completely different account, an AAD account. To the end user though, because the account is synced from AD to AAD, it will appear to them as the same account (assuming you've configured AAD Connect to do this of course and have setup pass through auth or password hash sync).

Answer 2

From what I read, the workstation can join Azure AAD over the internet (without vpn) and then with device writeback, be visible in local ad as a machine. This process can be done using the Intune connector without the use of VPN or network connectivity with the local domain controller

Yes, but this is unrelated to the device writeback functionality of AAD Connect.

Joining the domain is only half the battle though. For the user to log on initially and for any group policies to be applied, line of site to a domain controller is required -- there is no way around this and this is the purpose of the VPN. Thus, without a VPN connection, the scenario does not fully work.

I have a requirement where brand new laptops are automatically joined to the domain using autopilot.

What's driving this requirement? We strongly encourage orgs to AADJ their new Windows endpoints and avoid HAADJ for new endpoints altogether (for a variety of reasons including complexity and reliability).

berketjune2012 376 Reputation points

2022-03-14T18:41:57.193+00:00

HI @Jason Sandys

Thank you. I am actually planning to convince the client to go AADJ. Is there an article or documentation where it talks about the advantages over HAADJ? Something I can use to convince the client. This would solve our problem.

In the event the client insists on AADJ, how exactly would we get VPN to connect during the Autopilot phase, allowing the machine to join the domain? Is this a custom image or do we need to reach out to the VPN vendor for a solution?

Thanks

Share via

AutoPilot Azure Hybrid Join

1 additional answer

Your answer