Hybrid Azure AD join computer procedure

Question

Hi All,

We have configured AADC to sync on-prem AD object / password hash to O365 with ADFS for federation and access control.

We are planning to change our O365 from federated domain to managed domain, so we can dismiss the ADFS.
It will involve Hybrid Azure AD join our domain computers, setup Azure AD conditional access and then dismiss the ADFS, while keeping AADC to sync on-prem AD object / password hash to O365.

Original plan:

1. Setup AAD hybrid join with federation domain.
2. Windows 10 computer will auto AAD hybrid join.
3. Setup Conditional Access rules.
4. Change federation domain to managed domain.
5. Change AAD hybrid join to managed domain.
6. Dismiss ADFS.

According to Microsoft documents: "Beginning with Windows 10 1803, if the instantaneous hybrid Azure AD join for a federated environment by using AD FS fails, we rely on Azure AD Connect to sync the computer object in Azure AD that's subsequently used to complete the device registration for hybrid Azure AD join."

So I am thinking a new plan to simplify the steps:

1. AADC sync WIndows 10 computer to AAD
2. Setup SCP GPO to publish SCP to Windows 10 computers.
3. Windows 10 auto do the AAD hybrid join.
4. Setup Conditional Access rule.
5. Change federation domain to managed domain.
6. Dismiss ADFS.

Will this migration step work?

Thanks,
Roy

Answer 1

Hi @roy lee , the plan that you mentioned will definitely work. This is also documented at https://learn.microsoft.com/en-us/azure/active-directory/hybrid/plan-migrate-adfs-password-hash-sync#hybrid-azure-ad-joined-devices

Answer 2

Hi @Abhijeet-MSFT ,

Yes what you said is also I expect to happen. But I found that the Device registered instead of pending at the same time of the Add Device event in the Audit log.

Below is the Device List showing the Registered time:

And also, from the computer's event log, it also show the registration success at the same time.

It's strange.

Please advise.

Thanks,
Roy

Answer 3

Hi @Abhijeet-MSFT ,

Thanks for your reply.

I have tried 2 computers following Second Plan step 1-3.

A strange thing is the domain computer will appear on AAD before the AADC sync computer object to AAD.

The normal sequence according to other tech articles:

1. The domain computer found the SCP record, start to generate self signed certificate
2. Populate the user certificate attribute to on-prem AD computer object.
3. The domain computer try to do AAD hybrid join but failed because the computer object not yet sync to AAD by AADC.
4. AADC schedule sync the computer object to AAD only if the computer object has the user cert attribute.
5. The domain computer keep trying to do AAD hybrid join and then successfully finish the AAD join.

But in my case, the sequence is not same:

1. The domain computer found the SCP record, start to generate self signed certificate
2. Populate the user certificate attribute to on-prem AD computer object.
3. The domain computer successfully finish AAD hybrid join immediately.
4. AADC schedule sync and UPDATE the computer object in AAD because the computer object got the user cert attribute.

I have attached the Audit log to show the sequence.

Microsoft changed/improved the AAD hybrid join sequence? or anything wrong on my tenant?

Thanks,

Roy

Answer 4

HI @Abhijeet-MSFT , I will check in detail next Monday.

It may be possible. As I know it should be run and it will add or modify some claim rules in ADFS to handle the hybrid AAD join. But I didn't run AADC to configure the hybrid AAD join with my ADFS.

May I know what exact event log entries will show in ADFS when the computer do hybrid AAD join? So that I can verify?

Thanks,
Roy

Answer 5

Hi @Abhijeet-MSFT , attached the Get-AdfsClaimDescription and dsregcmd for output in it03-n machine.

65262-get-adfsclaimdescription.txt
65264-dsregcmd.txt

Thanks,
Roy