Confused about “Microsoft Entra joined” and “Microsoft Entra hybrid joined” PCs

[kennysarmy]

 

We currently use MDT to image devices which are then joined to our network and appear in Entra as Microsoft Entra hybrid joined.

We can then use group policy to control them along with Intune where that’s a better (or the only) option.

 

As MDT will soon go EOL I’ve been playing around with OSDCloud as a way to image devices, I’ve set it so it also enrols using AutoPilot during the process, with the devices then automatically added to AD in a separate OU that I’ve called “Intune Hybrid”.

 

The test devices appear in Entra as “Microsoft Entra joined” (not hybrid) – is this because of AutoPilot?

 

What are the implications if I then move the PC in AD to its correct OU?

 

We have no plans to ditch our on-prem servers at the moment but am looking to embrace some additional cloud resources such as making more use of Intune and Windows Update for Business (WUfB)

[itskdog]

What are your Autopilot settings? Does it meet all the requirements on the documentation: Windows Autopilot User-Driven Mode | Microsoft Learn

 

Does the device have line-of-sight to the DC during Autopilot?

[Rob_D]

11 minutes ago, kennysarmy said:

 

The test devices appear in Entra as “Microsoft Entra joined” (not hybrid) – is this because of AutoPilot?

Normally, Entra joined devices are cloud only, while Hybrid are devices synced from your local AD.

Device writeback (or whatever it's called now) can create entries for Entra devices in your local AD, but AFAIK it behaves more like a local cache and to be able to actually manage the devices in AD they would need to be hybrid joined (which in theory autopilot should be able to do).

[Boredguy]

For us it comes down to the autopilotConfiguration JSON file that we inject onto our devices as we install them to say if they are Hybrid join or Entra Join (full Azure) only when building with MDT, but should be the same for OSDCloud, as you need to provide the file so it knows the tenancy.

 

Then as long as it's matching your Domain Join policy in Intune to say where to store the computer in OU it should be ok providing the device with the Intune agent can add stations to the domain happily still

 

 

[robintech]

Don't think it matters to Entra/Intune if you move them in Local AD as you have to specify the local OU in the Intune Configuration and that can be anywhere, they should be showing up as  Microsoft Entra hybrid joined in Entra though

 

Though I've got a lot of "Microsoft Entra joined" duplicates or last active 6 months ago from failed enrolments when attempting to join them Hybrid 

[kennysarmy]

1 hour ago, itskdog said:

What are your Autopilot settings? Does it meet all the requirements on the documentation: Windows Autopilot User-Driven Mode | Microsoft Learn

 

Does the device have line-of-sight to the DC during Autopilot?

 

The AutoPilot Deployment Profile states:

 

Out-of-box experience (OOBE)

Edit

 

Deployment mode

User-Driven

Join to Microsoft Entra ID as

Microsoft Entra hybrid joined

Skip AD connectivity check

Yes

Language (Region)

English (United Kingdom)

Automatically configure keyboard

Yes

Microsoft Software License Terms

Hide

Privacy settings

Hide

Hide change account options

Hide

User account type

Standard

Allow pre-provisioned deployment

No

Apply device name template

No

 

 

 

Yes the device is connected to the network so should be able to see the DC during AutoPilot - I can't see why it wouldn't be able to....

[psydii]

We're old fashioned* and  just join them to the domain and let windows / entra connect to do the hybrid bit. A if very basic WCD profile does the initial domain join during OOBE. We have SCCM handling the enrollment to intune for now. But if you don't have that, you can do it with Group Policy  Enroll a Windows device automatically using Group Policy | Microsoft Learn

 

We don't have these devices configured for Autopilot.  My understanding is that if you have autopilot devices, then you need special profiles to AD join them as part of the OOBE.

 

 

*I used to be all about the clean built vanilla image, but these days with Lenovo Thinkpads and the Advantatge software, "as they come from the factory" is actually better and less work for us. Experiences on other hardware may vary.

[TheRobins]

It seems there are many ways to go about this and achieve sort of the end goal, typical Intune and Microsoft.

 

Personally this way we do a very basic MDT deployment (have also do this with  OSDisk but MDT is preffered) that installs Windows 11 and just gets the device to the OOBE screen. I then use Hardware ID into autopilot to pre-prevision the device. In that pre previsioning some apps are installed but is also joined into AD group, based on its group in autopilot. I prefer the control of using Hardware ID's as there maybe some machines I do not yet want to join to Entra/Ad but as base devices.