Configuring Hybrid Device Join On Active Directory with SSO

The instructions from Microsoft at https://docs.microsoft.com/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup are missing some of the steps on setting up hybrid device join to Azure AD. This is a complete list of steps when Pass-Thru auth with SSO is enabled on the domain.

Enable SSO – this is covered elsewhere. You can also do hybrid device join on a federated domain, though this is not covered here.
On your AADConnect server ensure that the MSOnline PowerShell add in is installed – this is the AdministrationConfig-3.msi executable that is needed to run cmdlets like Get-MSOLUser. Is only supported by the MSOnline PowerShell module version 1.1.166.0. To download this module, use this link
Open an administrative PowerShell

cd 'C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep'

```
Import-Module .\AdSyncPrep.psm1
```
This will enable the AD module and import some scripts for device writeback and device registration. We are looking at device registration here
```
$aadAdminCred = Get-Credential
```
#Enter a global admin credential
```
Initialize-ADSyncDomainJoinedComputerSync –AdConnectorAccount [connector account name] -AzureADCredentials $aadAdminCred
```
#[connector account name] is the name of your domain (domain.local for example) as shown in the AADConnect Synchronization Service Manager –
You should see the message “Initializing your Active Directory forest to sync Windows 10 domain joined computers to Azure AD.” followed by “Configuration Complete”. Errors about Azure Registration mean you are running the wrong version of the Azure AD PowerShell cmdlets
The required settings in AD (for one forest) are now done. If you have multiple forests, return to the above referenced document and run the script to register the Devices Registration Configuration node to AD
If you have conditional access available (have at least one Azure AD Premium licence assigned to your admin account) then you can add Trusted Sites to Azure AD to control where MFA prompts for device join will happen outside of. Add each office public NATed IP address with /32 (or whatever is needed at the end) into Azure Active Directory (under portal.azure.com) > Conditional Access > Named Locations > New Location
Add the same IPs to the “Configure MFA trusted IPs” link on the same page that you see the IP’s listed above
Your list of devices under Azure Active Directory should now increase as users reboot Windows 10 1703 machines and later. See the above document about the GPO setting needed to role this out to older versions of Windows (Workplace Join settings)

Posted

6 November 2017

Azure Active Directory, Azure AD, AzureAD, device, device registration, hybrid

Brian Reid

Tags:

Comments

15 responses to “Configuring Hybrid Device Join On Active Directory with SSO”

RKast

8 November 2017

I was encountering the problem that dcacls.exe was missing when tuning the ps1 script. Just copy paste from Windows server with AD tools.
Question i have, do we need to enable device sync in ad connect for hybrid azure ad join?

Thanks for this write up

Reply
1. Brian Reid
  
  8 November 2017
  
  Add-WindowsFeature RSAT-AD-Tools
  
  The above is needed on the AAD Connect server for all the tools and scripts here. This puts AD PowerShell and dacls on the server in the correct manner. Would suggest you do this to “fix” any dependencies with the copy and paste of the actual file.
  
  I always put the AD RSAT tools on the AAD Connect server as there is always a use for ADUC (dsa.msc) on the server as you need to examine sync errors etc.
  
  Reply
2. Brian Reid
  
  8 November 2017
  
  Regards AD Device Writeback (if that is what you mean by device sync) then no. Write back takes devi es registered (not joined) to AAD and syncs them back to AD DS for ADFS based conditional access. The OU/container with the computers in for hybrid AD Join is required to sync if doing SSO auth, but not if doing ADFS/federated auth
  
  Reply
  1. RKast
    
    8 November 2017
    
    Thanks for your reply and answer! yes i mean Device writeback, so no need fo that , check.
    
    Reply
  2. Jeremy Hagan
    
    9 February 2018
    
    Hi,
    By SSO auth do you mean password hash sync? I’ve followed these steps and enabled the Device Registraiton policy in GPO, but the devices aren’t registering. I’m using PTA with Seamless Single-SignOn
    
    Reply
    1. Brian Reid
      
      10 February 2018
      
      SSO Auth means “PTA with Seamless Single-SignOn”, or “PHS with Seamless Single-SignOn” Password hash sync on its own is not SSO
      
      Reply
  3. Neven
    
    4 March 2018
    
    Sorry if I’m being redundant, but your post and its comment section are the only place in the whole internet which comment on the necessity of device writeback for hybrid AAD join. So just to make sure: Setting up hybrid AAD join without AD FS (as per https://docs.microsoft.com/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) does *not* require an AAD P1 (or P2) license (including device writeback), the basic version that comes with our O365 subscription will do? Another confirmation would be very much appreciated! Thank you very much in any case!
    
    Reply
    1. Brian Reid
      
      6 March 2018
      
      Hybrid AAD Join is not restricted to a licence version. You need AAD Premium to make use of the hybrid join (such as device groups and conditional access) but to actually add the devices to the directory does not require a licence, just an Azure Active Directory synced from AD.
      
      Reply
RKast

9 November 2017

Sorry, 1 last question 🙂 in AD Connect we do not need to select the OU where the win10 devices are to sync to Azure/o365 ?

Reply
Brian Reid

9 November 2017

Only if your auth method is SSO. If your auth method is ADFS then you do not (check my second answer above – “The OU/container with the computers in for hybrid AD Join is required to sync if doing SSO auth, but not if doing ADFS/federated auth”)

Reply
1. RKast
  
  9 November 2017
  
  Yes that sentence triggered me to ask and double check 🙂 Once again many thanks Brian. Keep up those fantastic blog Posts.
  
  Reply
Emret

6 January 2018

Can someone help. I am getting below error:

Initializing your Active Directory forest to sync Windows 10 domain joined computers to Azure AD.
Get-ADRootDSE : The server has rejected the client credentials.
At C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1:571 char:21
+ $rootDSEEntry = Get-ADRootDSE
+ ~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [Get-ADRootDSE], AuthenticationException
+ FullyQualifiedErrorId : GetADRootDSE:BeginProcessing:InvalidCredentials,Microsoft.ActiveDirectory.Management.Commands.GetADRootDSE

Get-ADRootDSE : The server has rejected the client credentials.
At C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1:956 char:21
+ $rootDSEEntry = Get-ADRootDSE
+ ~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [Get-ADRootDSE], AuthenticationException
+ FullyQualifiedErrorId : GetADRootDSE:BeginProcessing:InvalidCredentials,Microsoft.ActiveDirectory.Management.Commands.GetADRootDSE

SearchADObject : Cannot bind argument to parameter ‘searchBase’ because it is an empty string.
At C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1:959 char:27
+ return SearchADObject $schemaDN $oneLevelSearchScope ldapDisplayN …
+ ~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [SearchADObject], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,SearchADObject

[ERROR] Active Directory Schema does not support container

Reply
1. Brian Reid
  
  7 January 2018
  
  In the error it says “Active Directory Schema does not support container”. So what version of the schema are you running on AD? Your forest functional level will help here, but you can prep a forest for a later schema than the server of the AD servers you are running.
  
  Reply
Sumit

17 April 2018

Hi,
I have successfully configured the hybrid azure AD environment and devices are showing hybrid azure AD join. But i am not able to login with the cloud user into the device which is hybrid azure AD join.
Thanks,

Reply
1. Brian Reid
  
  19 April 2018
  
  Sorry, I cannot help you here without more info. Error messages, event log, proxy status, firewall, what dsregcmd /status shows, what you have already done, what cloud auth type you are using, what your client version and patch level is etc… Sorry. Or give us a call for some consultancy rates, as the end to end pieces you need in place to get this to work now can be complex.
  
  Reply

Configuring Hybrid Device Join On Active Directory with SSO

Comments

15 responses to “Configuring Hybrid Device Join On Active Directory with SSO”

Leave a Reply to Brian Reid Cancel reply