hybrid join but can users sign in to laptop with AzureAD credentials?

Question

We want to role out new laptops to users using pre provisioning (formerly white glove). And have them joined to our internal domain as well as azure.

The problem is when the user would first get their laptop I can't see how they can sign in as it doesn't have their profile cached.

I've created a windows enrolment profile which is set to join azure ad as hybrid joined

I've created a a domain join profile as documented here: https://learn.microsoft.com/en-us/mem/intune/configuration/domain-join-configure

I've tested a new install of windows and signed in with my azure details which sets the laptop up fine and adds it to our internal active directory then reboots and asks for my domain\ login.

Since it's not on the vpn and only connected to the internet I can't login with that.

What are my options? How can I sign in with my azure ad credentials. Would I have to use AzureAd instead of Hybrid?

If that happens what would happen for the users when they return to the office for example if they wanted to print or access a file share or run an internal app that authenticates to ad.

Answer 1

How can I sign in with my azure ad credentials.

The systems must be fully Azure AD domain joined for a user to user their AAD account directly.

If that happens what would happen for the users when they return to the office for example if they wanted to print or access a file share or run an internal app that authenticates to ad.

In nearly all cases, it just works. See https://learn.microsoft.com/en-us/azure/active-directory/devices/azuread-join-sso.

As a note, none of this has anything to do with Autopilot.

Answer 2

Another way might be to use the fairly new feature in Autopilot "User driven hybrid azure ad join over VPN"

https://learn.microsoft.com/en-us/mem/autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join-with-vpn-support

https://oofhours.com/2020/06/23/windows-autopilot-user-driven-hybrid-azure-ad-join-over-the-internet-using-a-vpn/

I'm not sure if that works together with white glove tho, I haven't tested it.

Answer 3

I think ultimately we want to move away from a local domain so would prefer users to authenticate with their azure ad credentials but am left wondering how things would work once in the office.

Answer 4

Thanks for the link I have modified the title.