Hybrid join devices - no line of sight

Question

Hi all,

We have a hybrid active directory set up between our servers held in a DC and our Azure AD.

I am currently working on the configuration of our Autopilot and Intune deployment. At the moment we deploy new laptops manually, so I am looking at our configuration to make it more of a white glove experience.  

The devices will have line of sight access to a DC via a point to site VPN connection, but at the time of onboarding, they will not have line of sight access to the DC.

Am I better off just joining these devices to Azure AD rather than Hybrid joining them?  I understand that as we have AAD Connect setup, devices that are Azure AD joined should be able to access all resources in our "on prem" domain, is this correct?

Or should I still try and hybrid join the devices?  Will the devices pick up on prem GPO or will I need to move GPOs into Intune?

Thanks.

Answer 1

@Michael Lawson Thanks for posting in our Q&A.

From intune's point of view, you can still use hybrid Azure AD joined devices. For group policies, don't try to translate all of your existing GPOs to Intune policies. For a cloud-managed device, there are some group policies that don't apply to the scenario.

Use Microsoft policy analytics to help you understand if there are critical settings in your GPOs that you need to migrate to Intune.

https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics

Hope it will give you some ideas.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.