Azure AD join questions

[gshaw]

Since Win10 first went into beta I've been intrigued by the Azure AD join functionality and wanted to do more with it now we have the 1607 update and "shared PC" setup option.

 

There's a couple of niggles I wanted to iron out though and hoping we can get some insight via the forum... @Arthur @EduTech may have some views on the below?

 

1. Azure AD join wizard never succeeds when connecting via a proxy (WPAD) - seems odd it can't handle any form of proxy?
   Has anyone managed to get it to work in this scenario?
    
    
   
2. I've always thought of the Azure AD join as something for roaming devices, staff issued kit etc. but this article seems to be suggesting applying it to internal domain joined machines? What would you gain by doing this if ADFS is already performing SSO to O365 services? https://azure.microsoft.com/en-gb/documentation/articles/active-directory-azureadjoin-devices-group-policy/
    
    
   
3. is there any way to join to Azure AD without seemingly issuing a device to a user at install time?
    
   The Set up School PCs wizard seems to be able to do it but can't find much about automating with MDT. Reason being would be to ideally join the device to Azure AD before issuing to a user then they just sign in with O365 credentials when it's given to them. On the Surface 3 devices we've tried it with so far we have to go through a rather lengthy setup process that's a bit clunky to do in front of the user.
    
    
   

Edited August 4, 2016 by gshaw

[Arthur]

The Set up School PCs wizard seems to be able to do it but can't find much about automating with MDT.

I might be wrong but I think you need to create a provisioning package using the Imaging and Configuration Designer (ICD) in the latest Windows ADK and then apply that to your image using MDT.

 

Edited August 4, 2016 by Arthur

[gshaw]

Another interesting question, if we use the Setup School PCs wizard do they get assigned to whichever person joins them to Azure AD as "their" device? Seems AAD is geared towards BYOD scenarios and without InTune or similar system it doesn't seem to list "All Devices" or something along those lines in the Azure UI?

[EduTech]

@gshaw - If possible can you send me your WPAD File so that I can check what is occurring here as we maybe trying to get somewhere that hasn't been taken in to consideration in the WPAD File.

 

Thanks,

James.

[gshaw]

@EduTech can you PM me your contact details to send it over to?

 

I've had similar issues with WPAD and other Office 365 apps in that I have to put explicit rules in for certain domains otherwise we get connection problems (i.e. the final * rule doesn't seem to get interpreted properly). For example I had to add these to sort out Outlook and Word connection issues a while back, where X.X.X.X is the IP of our proxy server:

 

/* Send Office 2013 login via proxy here*/
if (shExpMatch(url, "*odc.officeapps.live.com*"))
{ return "PROXY X.X.X.X:8080";}

/* Send Outlook MAPI traffic via proxy here*/
if (shExpMatch(url, "*outlook.office365.com*"))
{ return "PROXY X.X.X.X:8080";}

 

If there's a particular set of domains for the Azure AD join that you're aware of post them here and I'll try adding those and see if it does the trick. In the past I've found the URLs using Fiddler but seeing as some of the process happens on the login screen it's a bit more awkward in this case.

Edited August 10, 2016 by gshaw

[Arthur]

If there's a particular set of domains for the Azure AD join that you're aware of post them here and I'll try adding those and see if it does the trick.

Not sure if this helps, but Microsoft have a long list of Office 365-related URLs/IPs here...

 

https://support.office.com/en-gb/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-GB&ad=GB

[gshaw]

Not sure if this helps, but Microsoft have a long list of Office 365-related URLs/IPs here...

 

https://support.office.com/en-gb/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-GB&ad=GB

 

One thing I've learnt from that list is that Microsoft lie

 

Had quite a few times new URLs have appeared before the list has updated and as for IP ranges, no chance of keeping up with it (we tried and thanks to CentralOps knew they were all MS ranges but hadn't been published in the documentation as such)

 

I guess the AAD Join is more of a Win10 \ Azure platform thing so probably uses different domains I'd guess.

Edited August 10, 2016 by gshaw