Azure AD join vs Hybrid Azure AD join - your experience in an enterprise environment?

Question

Hi,

Windows clients in an on premises environment have evolved from

Domain Joined
to
Hybrid Azure AD Join

The next step is

Azure AD Join

This is somewhat enabled by

How SSO to on-premises resources works on Azure AD joined devices
https://learn.microsoft.com/en-us/azure/active-directory/devices/azuread-join-sso

There's a good write-up at...

Azure AD join vs Hybrid Azure AD join - MDM Tech Space
https://joymalya.com/azure-ad-join-vs-hybrid-azure-ad-join/

What has been your experience in a complex enterprise environment? May be it was...

• tried it; didn't work; reverted
• tried it; worked; never looked back
• tried it; had to adapt some stuff (what?); now using it exclusively
• using Azure AD Join for laptops, hybrid Azure AD Join for desktops and servers
• something else

I appreciate my experience will be different to yours, but any experiences you can share will be helpful!

Suspect many people are in this transition situation, so answers on this public forum will be helpful to many.

Answer 1

Hi Anwar,

As you said it differs from environment to environment and there is some sort of similarlity when you go for Azure Hybrid or SSO deployment, I have come across various environments and issues some of them are :

• Legacy Applications integration
• Onpremise ADFS
• Legacy Operating System for Applications
• Multiple Forests and Domains - all having different FL/DL, User naming standards
• Windows Hello for Business - had issues with multiple domains and single AAD Connect
• Virtual Machine migrations sometimes doesnt work due to the configuration on the source servers customization
• Compliance and Security policies tagging in O365 is very good but testing is required prior to deployment wider audience
• Conditional Access Policies is a excellent tool but requires lot of testing and mapping of user base and devices
• If you are starting try implementing Zero Trust so security is important and baselining the current env will be good
• Password Policies and implementaton - read about it over here in the faqs - active-directory-faq
• Follow the checklist and all the important bits - active-directory-deployment-checklist-p2

Hope this helps and provide some info for your project.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello there,

Thank you for sharing your insights, I have shared a information which I came across this thread https://learn.microsoft.com/en-us/answers/questions/33891/difference-between-azure-ad-registered-azure-ad-jo.html

Hybrid Azure AD Joined is for:
corporate owned and managed devices
Authenticated using a corporate user id that exists at local AD & on AAD.
Authentication can be done using both: On-Prem AD & Azure AD.

Azure AD Joined is for
Corporate-owned and managed devices
Authenticated using a corporate id that exists on Azure AD
Authentication is only through AAD.

AAD Registered Device is for
Personally owned corporate enabled
Authentication to the device is with a local id or personal cloud id

---------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–