Servers Showing as Hybrid Azure AD Joined Outside of Sync Scope – Why?

Question

Servers Showing as Hybrid Azure AD Joined Outside of Sync Scope – Why?

Nawal Almuajel 0 Microsoft Employee

Hi everyone,

We have a server that appears as Hybrid Azure AD joined in the Entra portal, even though it's not located in an OU that's included in the Azure AD Connect sync scope. We've confirmed there are no group policies applied to this server that would trigger hybrid join.

Previously, we had SCCM configured to enable automatic Intune enrollment for all devices, but we’ve since narrowed it down to a specific device collection. Despite that, we’re still seeing servers and devices registering as hybrid joined in Entra ID.

How can we stop servers outside the sync scope from registering as hybrid joined and why is the sync happening?

0 comments

1 answer

Your answer

Answer 1

Anonymous

Hi @Nawal Almuajel,

Based on your query, here is my understanding: Devices are getting hybrid AD join without in sync scope.

In order to identify the devices are not in sync scope by any means, please make sure to search the device with device name in metaverse search of sync service manager. Here is the Microsoft document which might help you on the same: Sync Service Manager Metaverse Search.

As you have also configured SCCM for your devices, I believe this might also have some impact since the device has their own SCP configured from your end. Kindly re check whether SCP is running for the devices at any given time due to any policies.

If this does not help you and if there is no requirement of the device on Azure, you can swiftly remove the device from Azure and keep it as domain join in your on-premises. Once removed make sure there are no policies or the device object available in Entra AD connect or SCCM policies applied to the device. If there is any appear of the device again Entra ID, you can check the latest logs of Entra AD connect or SCCM policies then we might know exact cause of it and remove it accordingly.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".

Nawal Almuajel 0 Reputation points Microsoft Employee

2025-04-15T07:27:11.22+00:00

How can I check if the SCP is running on the device?
Anonymous

2025-04-15T23:14:50.4766667+00:00

Hi @Nawal Almuajel,

Could you please check the following registry entry on your hybrid AD join server which have tenant name and tenant ID as values:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD]:
Tenant Name: "" Tenant ID: ""

This has configuration has been specified in the following document: Configure client-side registry setting for SCP.

Please check and let me know if you have any further queries on the same.
Anonymous

2025-04-16T16:43:42.93+00:00

Hi @Nawal Almuajel,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Anonymous

2025-04-17T18:14:08.4033333+00:00

Hi @Nawal Almuajel,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.