Join Windows 10 Computer to Azure AD Using Hybrid Domain Join Method

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

We're going to see the steps on how to join Windows 10 or later machines to Azure Active Directory using hybrid domain join method. If you have an on-premises Active Directory domain services environment and you want to join your domain joined computers to Azure Active Directory we can accomplish this task by doing hybrid Azure AD join. When we hybrid join a device it means that it is visible in both our on-premises Active Directory and in Azure Active Directory, and then we can manage them from both.

Prerequisites:

We have two VMs for this set up:

  • Domain controller (Windows Server 2016) - synced with Azure Active Directory using Azure AD connect tool
  • Windows 10 client computer - joined to on-premises active directory
Note:To perform these steps you must have access to both an on-premises (Windows Server) administrator and an Azure AD global administrator.
  1. Open Azure AD Connect
  2. Click on Configure
  3. Click on Configure device options and click Next
  4. Click on Next
  5. Enter Azure AD tenant Global Administrator credentials and click Next
  6. With Configure hybrid Azure AD join option pre-selected, click Next
  7. Select Windows 10 or later domain join devices and click Next
  8. Configure authentication service
    1. Select the check box in front of your forest
    2. Click the drop down arrow and choose Azure Active Directory for Authentication Service
    3. Click Add
  9. Provide admin account credentials, click Ok and Next
  10. Click Next and then Configure to start the process
  11. Click Exit when configuration completes
  12. Run PowerShell command to sync Azure AD
    Run Start-ADSyncSyncCycle -PolicyType delta on Admin PowerShell
  13. Reboot Windows 10 device to confirm registration
  14. After reboot, sign into Windows 10 computer
  15. Verify the hybrid join status
    1. Open Command Prompt and type dsregcmd /status
      Check that AzureAdjoined and DomainJoined both show as YES under device state
    2. Alternatively, verify in Azure portal:
      1. Log into Azure portal
      2. Go to Device>All Devices
      3. Verify join type shows as hybrid Azure AD join

Verify that both Owner and MDM columns are present in all devices pages. If not, see Add UPN suffixes and update your users to them (Microsoft) for troubleshooting information.