Apply Computer Configuration GPOs to an Azure AD Domain Service.

Smadatek STS 1

I am trying to put restrictions on users through the computer configurations but when I join the computer to the Azure AD, it is not showing in the AADDC Computers so Computer Configurations are not applying. How do I get the computers joined to the Azure AD to connect to the managed domain.

2 answers

Andreas Baumgarten 108K Reputation points MVP

2020-10-01T21:50:04.507+00:00

I always join the VMs (Windows Server) directly in the Azure AD Domain Service domain, not in the Azure AD. Never had an issue with this way.
VMs are visible in the AADDC Computers OU right after the domain join.

Which OS is installed on your computer?

Regards
Andreas
Please sign in to rate this answer.

1 person found this answer helpful.
JamesTran-MSFT 36,596 Reputation points Microsoft Employee

2020-10-05T16:59:52.907+00:00

@Smadatek STS
I just wanted to check in and see if you required additional assistance or if you were able to resolve this issue?

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Smadatek STS 1 Reputation point

2020-10-05T21:11:38.433+00:00

I have the VM Windows Server 2016. The Server is joined to the AD Domain Service. I can see the Server in the OU Computers folder. I have a physical laptop with Windows 10 that I joined to Azure Active Directory. I am unable to see the laptop in the OU Computers folder. The only virtual machine is the server. The rest are going to be physical devices.
Please sign in to rate this answer.
JamesTran-MSFT 36,596 Reputation points Microsoft Employee

2020-10-06T17:52:44.497+00:00

@Smadatek STS
Thanks for your quick response!

-For your physical laptop with Windows 10, are you going to be using Intune to enroll this device? Or have you been using Intune and still aren't able to see the laptop in the OU computers folder?
-Are you following any documentation? If so, can you please provide it here.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Smadatek STS 1 Reputation point

2020-10-06T18:00:00.45+00:00

We do not have Intune enabled. We are on the standard plan with Azure Domain Services Enabled. The article I am attaching here made no statement of requiring Intune.

https://learn.microsoft.com/en-us/answers/questions/114585/apply-computer-configuration-gpos-to-an-azure-ad-d.html?childToView=118290#comment-118290

So my question is. For the computers to be assigned to the OU Computers folder and allow for altering GPOs. Do we need the Intune subscription WITHOUT an onsite hybrid Server. Will the AD Joined Computers show up in the ADDC Computers OU for us to be able to edit the GPOs.

JamesTran-MSFT 36,596 Reputation points Microsoft Employee

2020-10-06T21:33:43.963+00:00

@Smadatek STS
Thank you for the quick reply!

Are you able to repost the documentation URL? It looks like you accidently pasted this thread's URL.

When it comes to Intune, I was mainly asking to see if you're using it, since you mentioned a physical device that you joined to AzureAD. However, if the documentation you're following doesn't mention the use of Intune, that's perfectly fine!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Smadatek STS 1 Reputation point

2020-10-06T22:28:59.053+00:00

Here is the link. There was nothing in it about requiring Intune however I am not 100% aware of how Intune works and if we were required to be enrolled in Intune for GPOs to work.

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy

My question is still though, We are currently Not Enrolled with Intune. We do not have any Premium licenses either. If we were to be enrolled in Intune, and the physical PC is enrolled in Intune, will it pull GPO policies from the Virtual Server that is joined to the Domain.

Again. We have Azure ADDS with standard plan and not enrolled in Intune. We have a Windows Server 2016 VM through Azure that is joined to the domain that is being used as a GPO policy server. What I need is for physical computers to be assigned to the ADDC Computers in the azure domain so those GPOs can be applied.

If we were enrolled in Intune, do those computers show up in the ADDC Computers folder and will GPOs be applied.

JamesTran-MSFT 36,596 Reputation points Microsoft Employee

2020-10-07T23:07:38.493+00:00

@Smadatek STS
Thank you for the link and additional details, I reached out to my team for assistance with this issue and will post our findings below.

Findings:
When it comes to physical device restrictions with Azure AD DS, neither AADDS authentication nor on-premises AD DS authentication is supported against Azure AD-joined devices or Azure AD-registered devices. Which means, you won't be able to domain join your physical device to AADDS and apply your GPO.

Next Steps:
Regarding your Intune question, I have add the "Intune" tags to this thread so an engineer from their forum can further assist.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Apply Computer Configuration GPOs to an Azure AD Domain Service.

2 answers

Your answer