Configuring Hybrid Device Join On Active Directory with SSO

Posted on Posted in Azure Active Directory, Azure AD, AzureAD, device, device registration, hybrid

The instructions from Microsoft at https://docs.microsoft.com/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup are missing some of the steps on setting up hybrid device join to Azure AD. This is a complete list of steps when Pass-Thru auth with SSO is enabled on the domain.

  1. Enable SSO – this is covered elsewhere. You can also do hybrid device join on a federated domain, though this is not covered here.
  2. On your AADConnect server ensure that the MSOnline PowerShell add in is installed – this is the AdministrationConfig-3.msi executable that is needed to run cmdlets like Get-MSOLUser. Is only supported by the MSOnline PowerShell module version 1.1.166.0. To download this module, use this link
  3. Open an administrative PowerShell
  4. cd 'C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep'
  5. Import-Module .\AdSyncPrep.psm1
  6. This will enable the AD module and import some scripts for device writeback and device registration. We are looking at device registration here
  7. $aadAdminCred = Get-Credential

    #Enter a global admin credential

  8. Initialize-ADSyncDomainJoinedComputerSync –AdConnectorAccount [connector account name] -AzureADCredentials $aadAdminCred

    #[connector account name] is the name of your domain (domain.local for example) as shown in the AADConnect Synchronization Service Manager –

  9. You should see the message “Initializing your Active Directory forest to sync Windows 10 domain joined computers to Azure AD.” followed by “Configuration Complete”. Errors about Azure Registration mean you are running the wrong version of the Azure AD PowerShell cmdlets
  10. The required settings in AD (for one forest) are now done. If you have multiple forests, return to the above referenced document and run the script to register the Devices Registration Configuration node to AD
  11. If you have conditional access available (have at least one Azure AD Premium licence assigned to your admin account) then you can add Trusted Sites to Azure AD to control where MFA prompts for device join will happen outside of. Add each office public NATed IP address with /32 (or whatever is needed at the end) into Azure Active Directory (under portal.azure.com) > Conditional Access > Named Locations > New Location
    image
  12. Add the same IPs to the “Configure MFA trusted IPs” link on the same page that you see the IP’s listed above
  13. Your list of devices under Azure Active Directory should now increase as users reboot Windows 10 1703 machines and later. See the above document about the GPO setting needed to role this out to older versions of Windows (Workplace Join settings)

7 thoughts on “Configuring Hybrid Device Join On Active Directory with SSO

  1. I was encountering the problem that dcacls.exe was missing when tuning the ps1 script. Just copy paste from Windows server with AD tools.
    Question i have, do we need to enable device sync in ad connect for hybrid azure ad join?

    Thanks for this write up

    1. Add-WindowsFeature RSAT-AD-Tools

      The above is needed on the AAD Connect server for all the tools and scripts here. This puts AD PowerShell and dacls on the server in the correct manner. Would suggest you do this to “fix” any dependencies with the copy and paste of the actual file.

      I always put the AD RSAT tools on the AAD Connect server as there is always a use for ADUC (dsa.msc) on the server as you need to examine sync errors etc.

    2. Regards AD Device Writeback (if that is what you mean by device sync) then no. Write back takes devi es registered (not joined) to AAD and syncs them back to AD DS for ADFS based conditional access. The OU/container with the computers in for hybrid AD Join is required to sync if doing SSO auth, but not if doing ADFS/federated auth

  2. Sorry, 1 last question 🙂 in AD Connect we do not need to select the OU where the win10 devices are to sync to Azure/o365 ?

  3. Only if your auth method is SSO. If your auth method is ADFS then you do not (check my second answer above – “The OU/container with the computers in for hybrid AD Join is required to sync if doing SSO auth, but not if doing ADFS/federated auth”)

    1. Yes that sentence triggered me to ask and double check 🙂 Once again many thanks Brian. Keep up those fantastic blog Posts.

Leave a Reply

Your email address will not be published. Required fields are marked *