Manage AAD Joined computers with on prem AD

Question

Manage AAD Joined computers with on prem AD

Wesley Ramon 36

Hi All,

I'm trying to find an answer to the question in Title but I'm confused.

I have a .local domain in an on-premise environment with azure ad sync.

most of our computers are Hybrid AAD Joined , but I'm wondering if there is a way to apply GPO's from our local DC's to a computer that is Azure AD Joined , for example if we ship a laptop to one of our users, the users log's into the laptop with his azure credentials , computers is added to the Azure AD , and i want to apply GPO's on that laptop. This also apply's for joining the laptop to specific Groups in active directory.

Thanks

2 answers

Your answer

Answer 1

James Hamil 27,211 Microsoft Employee Moderator

Hi @Wesley Ramon , Azure AD joined devices don't have a computer object in on-premises Active Directory Domain Services (AD DS), so applying GPOs from your local DCs to Azure AD joined devices is not directly possible. However, you can use Azure AD Domain Services to create and manage group policies in a managed domain.

For hybrid Azure AD joined devices, you can apply GPOs from your local DCs since they have a computer object in AD DS. To join a device to specific groups in Active Directory, you can use the Active Directory Users and Computers (ADUC) snap-in.

Keep in mind that SSO access to on-premises resources requires line-of-sight communication with your on-premises AD DS domain controllers. If Azure AD joined devices aren't connected to your organization's network, a VPN or other network infrastructure is required.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Wesley Ramon 36 Reputation points

2023-06-20T06:23:41.41+00:00

Hi James,

you can use Azure AD Domain Services to create and manage group policies in a managed domain.

with managed domain , do you mean my .local domain on prem ?

For hybrid Azure AD joined devices, you can apply GPOs from your local DCs since they have a computer object in AD DS. To join a device to specific groups in Active Directory, you can use the Active Directory Users and Computers (ADUC) snap-in.

This is the way I've been doing it for years. I was just wondering if there is a strategy in place where we could add a computer to azure, but still with the benefits of managing it on premise like it is joined locally in the network.

Regards
James Hamil 27,211 Reputation points Microsoft Employee Moderator

2023-06-20T21:01:30.8233333+00:00

Hi Wesley, I was talking about an ADDS managed domain, separate from your on-premises .local domain.

For the scenario you mentioned, unfortunately you can't manage it on premises.

Answer 2

Carlos Solís Salazar 18,191 MVP Volunteer Moderator

Thank you for asking this question on the Microsoft Q&A Platform.

There is no way to administrate those devices with your Local DC.

Hope this helps!

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.

NOTE: To answer you as quickly as possible, please mention me in your reply.

Share via

Manage AAD Joined computers with on prem AD

2 answers

Your answer