How can I perform Hybrid Azure AD join for my OnPremise AD computer to allow SSPR?

EnterpriseArchitect 4,741 Reputation points
2023-03-20T14:54:15.0766667+00:00

Folks,

I need your help and suggestion in performing the Hybrid Azure AD join. However in the Steps #4: https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-assign I cannot see my AD joined computer listed?

My current setup is single forest OnPremise AD Domain synched using Azure AD connect, with Azure AD Premium P2 licensing.

Any help would be greatly appreciated.

Thanks.

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,885 questions
Microsoft Intune Configuration
Microsoft Intune Configuration
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Configuration: The process of arranging or setting up computer systems, hardware, or software.
1,725 questions
Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
1,253 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,356 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,532 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 95,581 Reputation points MVP
    2023-03-20T15:08:43.7+00:00

    You will not see individual devices therein, use Groups instead. The Group needs to already exist and has the required devices (or users) added. If you want to target all devices, hit the corresponding Add all users/Add all devices buttons.

  2. Crystal-MSFT 43,126 Reputation points Microsoft Vendor
    2023-03-21T01:53:39.0266667+00:00

    @EnterpriseArchitect, Thanks for posting in Q&A. From the link you provided, I notice you want to assign Intune Device Configuration policy to user or device group. But the device is not existing. If there's any misunderstanding, feel free to let us know.

    On my point of view, this can be that the device is not enrolled into Intune yet.

    To perform Hybrid Azure AD join, you can firstly sync password hash with Azure AD connect:

    https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#enable-password-hash-synchronization

    Then configure Hybrid Azure AD join with the steps in the following link. There are two options to choose. If it is managed domain, you can try the steps under "Managed domains". If you have federated domain, try the steps under "Federated domains".

    https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-hybrid-azure-ad-join

    Based on my experience, if the domain is non-routable, it will cause AzureADPrt as no. To make it work, we can add the new UPN suffix as a workaround. For example, if your on-premise domain is "A.com". And you Azure AD domain is "B.com". And the domain is non-routable, then you can add "B.com" under the Active Directory Domains and Trusts as a new UPN suffix. And change the UPN suffix for existing users.

    https://learn.microsoft.com/en-us/microsoft-365/enterprise/prepare-a-non-routable-domain-for-directory-synchronization?view=o365-worldwide

    However, if the Hybrid Azure AD join still have issue, you can contact Azure AD support to get more help.

    After the device is Hybrid Azure AD joined, we can choose one of the device enrollments for Hybrid Azure AD joined devices to enroll into Intune. Here are some methods for your reference:

    GPO enrollment (Mainly for the existing domain joined devices.)

    https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

    Autopilot Hybrid Azure AD joined (Mainly for new devices)

    https://learn.microsoft.com/en-us/mem/autopilot/windows-autopilot-hybrid

    As a note, please ensure the user also has the Microsoft Intune license assigned.

    Hope the above information can help.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.