Share via

Migration from Hybrid to AAD

DerekR 26 Reputation points
2021-08-03T15:55:02.847+00:00

I am trying to do my research on migrating off of our hybrid environment to AAD. All of our workstations are Hybrid joined. Will I need to remove them from the on-prem AD and add them back to AAD? Any links to documentation would be appreciated.

Thanks,

Derek

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,211 questions
0 comments
Accepted answer
  1. Siva-kumar-selvaraj 15,571 Reputation points
    2021-08-06T20:48:21.237+00:00

    Thanks for reaching out.

    When you say Hybrid, I assume you mean Hybrid Azure AD Join. If you are not sure about current state of devices then I would recommend you to use dsregcmd /status utility and figure out current state of device ( example : DJ, HAADJ, or WPJ ) before remove devices from the on-prem AD.

    This utility must be run as a domain user account which lists the device join state parameters.

    Sample device state output:

    Domain Joined (DJ):
    121303-image.png

    Hybrid Azure AD Joined (HAADJ):
    121311-image.png

    Workplace Joined (WPJ):
    121255-image.png

    Refer below steps to perform cleanup depends on current device state of windows 10 devices, once that has completed then you can perform Azure AD Join.

    Domain Joined (DJ):
    This would be straight forward, whereas unjoin devices from the on-prem AD and then disable or delete Windows 10 devices in your on-premises AD.

    Hybrid Azure AD join
    For hybrid Azure AD joined devices, make sure to turn off automatic registration in AD using the Controlled validation article. Then the scheduled task won't register the device again. Next, open a command prompt as an administrator and enter dsregcmd.exe /debug /leave . Or run this command as a script across several devices to unjoin in bulk.

    and remove devices from the on-prem AD and then Disable or delete Windows 10 devices in your on-premises AD, and let Azure AD Connect synchronize the changed device status to Azure AD. Reference: https://learn.microsoft.com/en-us/azure/active-directory/devices/faq#hybrid-azure-ad-join-faq

    Workplace Joined (WPJ)/Azure AD Registered
    Remove Workplace Joined as per this link and remove devices from the on-prem AD and then Disable or delete Windows 10 devices in your on-premises AD, and let Azure AD Connect synchronize the changed device status to Azure AD.

    I would strongly recommend to refer this article, Cleanup Azure AD Devices.

    ------
    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    2 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Russell Johnson 6 Reputation points
    2022-11-22T22:57:16.98+00:00

    Would moving the hybrid joined device to an un-synched OU be enough like controlled validation to allow us to remove it from AD and AAD so it can be re-joined to AAD only?