Hi, It will be a long post, so... I have a problem with hybrid joined devices and Conditional Access (set to require hybrid joined device). Our users from time-to-time are unable to use apps because of this. Infrastructure: local Active Directory with few DC's DC synced to Entra ID (both users and computers) Conditional Access policy set to "require hybrid joined devices" Problem occurs for many users:(yes, propably some of them are positive-positive, they used private device, but still we've got many complaints about it). What I discovered to this day: it can occurs in the middle of the day, without any changes (afaik) in object in AD users been talking it occurs when they change password (don't take it too seriously) in fact IT OCCURS because some of devices are DELETED from cloud Example 1: PC deleted (question is why?) - look at date and time PC added - in the same cycle? 3. When it's added (after few minutes of pending) user can sign in... Example 2: PC deleted PC added (look at difference in time) PC logs - it's been deleted by SYNC account And propably the most important here: there was a change in this PC object " userCertificate " attribute. There is a rule on Entra ID Connect that states this attribute must NOT BE EMPTY. So it looks like something deleted this attribute and then re-writed it? The fact is this PC was deleted without any user activity, so it looks like some hidden proces, rule or aliens did that. I've got many more evidences but they are most likely the same, but not in every casy "userCertificate" was re-writed. Look how many devices were deleted. Almost every were re-added again. Sometimes there is a change in "userCertificate" attribute which is required for device to be synced. Might there be a problem with SCP? I am investigating this problem for so long and I am just tired of it...

Additional information: Sometimes devices are not deleted from AAD. Today we've got another user with this problem, but there was no change at his computer and it went from "registered" to "pending" and it can't register for a long time. I've checked an in the past it was the most ocuring scenario, devices haven't been deleted but changed state. No changes in Entra ID Connect: No changes in userCertificate: I know I can use dsregexe to join this certain computer to AAD, but it is not the case. I want to fix the problem...

Hybrid joined devices syncing problem

adv_kd 125

Hi,
It will be a long post, so...

I have a problem with hybrid joined devices and Conditional Access (set to require hybrid joined device). Our users from time-to-time are unable to use apps because of this.

Infrastructure:

local Active Directory with few DC's
DC synced to Entra ID (both users and computers)
Conditional Access policy set to "require hybrid joined devices"

Problem occurs for many users:(yes, propably some of them are positive-positive, they used private device, but still we've got many complaints about it).

What I discovered to this day:

it can occurs in the middle of the day, without any changes (afaik) in object in AD
users been talking it occurs when they change password (don't take it too seriously)
in fact IT OCCURS because some of devices are DELETED from cloud

Example 1:

PC deleted (question is why?) - look at date and time
PC added - in the same cycle? 3. When it's added (after few minutes of pending) user can sign in... Example 2:
1. PC deleted
1. PC added (look at difference in time)
1. PC logs - it's been deleted by SYNC account

And propably the most important here:

there was a change in this PC object "userCertificate" attribute. User's image

There is a rule on Entra ID Connect that states this attribute must NOT BE EMPTY. So it looks like something deleted this attribute and then re-writed it? The fact is this PC was deleted without any user activity, so it looks like some hidden proces, rule or aliens did that.

I've got many more evidences but they are most likely the same, but not in every casy "userCertificate" was re-writed.

Look how many devices were deleted. Almost every were re-added again.
User's image

Sometimes there is a change in "userCertificate" attribute which is required for device to be synced.

Might there be a problem with SCP?

I am investigating this problem for so long and I am just tired of it...

3 answers

adv_kd 125 Reputation points

2024-02-09T09:15:46.5866667+00:00

Additional information: Sometimes devices are not deleted from AAD. Today we've got another user with this problem, but there was no change at his computer and it went from "registered" to "pending" and it can't register for a long time. I've checked an in the past it was the most ocuring scenario, devices haven't been deleted but changed state.

No changes in Entra ID Connect:

No changes in userCertificate:

I know I can use dsregexe to join this certain computer to AAD, but it is not the case. I want to fix the problem...
Please sign in to rate this answer.

1 person found this answer helpful.
Akshay-MSFT 17,786 Reputation points Microsoft Employee

2024-02-09T12:29:40.9+00:00

@adv_kd

Thank you for posting your query on Microsoft Q&A, in order to dig through what is causing the devices to break sync and move to pending status, we need the check the following:

On the impacted device, kindly run dsregcmd /status in cmd and share output SSO state.

Get the event logs : Applications and Services Log > Microsoft > Windows > Microsoft Entra ID and look for error and share the same with me.

Thanks,

Akshay Kaushik

adv_kd 125 Reputation points

2024-02-12T12:34:47.05+00:00

Hello,
Screenshot attached.

Funny thing - in Entra when I check PC details - everything looks fine.

About logs - there is a bunch of them in past 12h, I took them from this tab:

If you'd like to see them I will export them into .evtx but I would like to send them directly for you, there is sensitive data...

adv_kd 125 Reputation points

2024-02-12T14:45:31.5166667+00:00

Some additional info from PowerShell: Weird thing is that on second screenshot it says that device is connected to AAD as hybrid, on first it says that device is not connected... And it's still visible in Entra ID (not pending), I've checked it 5 mins ago.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
adv_kd 125 Reputation points

2024-02-16T13:35:45.0633333+00:00

Hi,
Does anyone have an idea?
Please sign in to rate this answer.
Akshay-MSFT 17,786 Reputation points Microsoft Employee

2024-02-23T06:50:19.2666667+00:00

@adv_kd
I am reviewing the above shared information and will keep you posted with further inputs. Thanks, Akshay Kaushik

adv_kd 125 Reputation points

2024-02-26T14:28:16.1433333+00:00

Hello @Akshay-MSFT
Thank you, I am waiting, because this problem is really pain in the neck.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more