device enabled for co-mangement inot getting Hybrid AD joined

Question

Hello,

We are doing a co-management setup for a client who is currently not on cloud. we are getting Azure AD for the infra, and they want to install M365 office suit pack from Intune to existing domain joined Windows 10 devices. In order to get this we are enabling the co-managemnet setup with SCCM, so far below steps are done but when trying to test a Windows device, it is not getting Hybrid AD joined. Attempted manual join with Azure AD, which also seems to get broreaks halfway with no progress.

The steps performed so far

1. hybrid AD enabled for Win10 devices at Azure AD connect
2. a AD group with Test machine was created and synced to Azure
3. GPD for MDM enrollment is assigned to above group
4. Autoenrollment enabled at Intune for Windows 10 device
5. User group with license assigned for autoenrollment at previous step
6. Comanagemnet configured in SCCM
7. pilot collection assigned to workgroups and group from step two is memebr of this collection
8. client setting for cloud join is enabled by default

On a test device registered in Azure, a test account with license was used to sign into the device with local credentials.
The device was not joined and below event was observed in the event viewer in below path:

Applications and Services Log > Microsoft > Windows >DeviceManagement-Enterprise-Diagnostics-Provider> Admin

Request assistance to help resolve this issue and get teh setup working. Can this be because of fireall block ?

also could you help me understand if users who nevr used azure services till date, the day their account is synced to azure and license is assigned, will co-management work from their local login using AD username and password without any additional steps?

Appreciate any hep on this topic

Answer 1

@svjs-0437 , In fact, Hybrid Azure AD join is one prerequisite for co-management enroll.
https://learn.microsoft.com/en-us/mem/configmgr/comanage/tutorial-co-manage-clients

From your description, it seems the device is not Hybrid Azure AD joined successfully. Here, you can follow the following article to troubleshoot.
https://learn.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current

For your questions, about the firewall block, you can check if the network resources in the following link are all accessible via your firewall.
https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-hybrid-azure-ad-join#network-connectivity-requirements

In fact Hybrid Azure AD join device is login using on-premise domain account. But we need to ensure the on-premises AD users UPN is support for hybrid Azure AD join. Here is a link iwth more details
https://learn.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan#review-on-premises-ad-users-upn-support-for-hybrid-azure-ad-join

Meanwhile, as the issue is with Hybrid Azure AD join and we are Intune support. To get better support, I have added the tag "azure-active-directory" and "azure-ad-hybrid-identity" to see if the related support can be involved to help on this. If no, you can contact Azure AD support to get more help:
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-troubleshooting-support-howto

After the Hybrid Azure AD join device issue is fixed and all the prerequisites are met, we can plan to do co-management, we can follow the steps in the first article to do the enroll.

In your description, I notice we configure GPO. Based as I know, GPO enrollment is another method, we can choose either co-management or GPO to do the enrollment, no need for both. Here is an article with more details for the reference:
https://learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment#windows-enrollment-methods

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Issue was due to device not properly syncing with Azure, post sync the setup worked fine.