View source for 📙 Device and Hybrid Management

= Device and Hybrid Management =

== [[Register vs Join vs Hybrid Join – Device Types Explained]] ==
=== 1. Azure AD Registered ===
* Used for personal/BYOD devices (typically mobile/laptops).
* Only the user identity is associated with Azure AD.
* No full device control by admin.

=== 2. Azure AD Joined ===
* Devices are fully joined to Azure AD.
* Mainly used for corporate-owned devices.
* Provides full SSO and Intune compliance policies.

=== 3. Hybrid Azure AD Joined ===
* Devices are joined to on-prem Active Directory and registered in Azure AD.
* Ideal for orgs with existing AD infrastructure moving to the cloud.
* Requires Azure AD Connect and GPO.

== [[How to Join Windows Device to Azure AD]] ==
=== Manual Join via Settings ===
# Open '''Settings > Accounts > Access work or school'''
# Click '''Connect'''
# Choose '''Join this device to Azure Active Directory'''
# Enter user email and credentials
# Device restarts and joins Azure AD

=== Post-Join Verification ===
* Go to '''Settings > Accounts > Access work or school''' → Azure AD account should be listed.
* Run `''dsregcmd /status''` in Command Prompt to verify:

  * `AzureAdJoined : YES`
  * `DeviceId`, `TenantId`, etc.

== [[Entra Join vs Intune Enrollment Differences]] ==
=== Entra ID Join ===
* Azure AD identity is linked to the device.
* Required for enforcing Conditional Access and cloud policies.
* Enables SSO to Microsoft 365 and other Azure services.

=== Intune Enrollment ===
* Intune manages device configuration, security, compliance.
* Needed for device configuration profiles, app deployment, etc.

== Key Differences: Register vs Join vs Hybrid Join ==

{| class="wikitable"
! Feature !! Azure AD Registered !! Azure AD Joined !! Hybrid Azure AD Joined
|-
| Device Ownership || Personal (BYOD) || Corporate || Corporate (Domain-joined)
|-
| Join Method || User registers manually || User joins during setup || GPO + Azure AD Connect
|-
| User Sign-in || Local account + Work account || Azure AD credentials || AD credentials (SSO with Azure AD)
|-
| Device Management || Limited (Intune optional) || Fully manageable via Intune || On-prem GPO + Intune optional
|-
| SSO to Azure Services || Yes (limited) || Full SSO || Full SSO
|-
| Suitable For || BYOD or external users || Cloud-native enterprises || Hybrid environments
|-
| Requires AD Connect || No || No || Yes
|-
| Device appears in Azure AD? || Yes || Yes || Yes
|-
| Device appears in On-prem AD? || No || No || Yes
|}

== [[Hybrid Azure AD Join – Step-by-Step Configuration]] ==
=== Prerequisites ===
* On-prem AD + Azure AD tenant
* Azure AD Connect
* Windows 10/11 Enterprise or Pro
* Valid device DNS

=== Step-by-Step Guide ===
# Install & Configure Azure AD Connect
* Enable '''Device Writeback'''
* Enable '''Hybrid Azure AD Join'''
# Configure GPO
* Navigate to '''Computer Configuration > Administrative Templates > Windows Components > Device Registration'''
* Enable '''Register domain-joined computers as devices'''
# Check Sync
* Force sync: `Start-ADSyncSyncCycle -PolicyType Delta`
* Verify with `dsregcmd /status` (check for '''HybridAzureADJoined : YES''')

== [[Enable Auto Enrollment to Intune via GPO]] ==
=== Prerequisites ===
* Azure AD Premium license
* Device must be Azure AD or Hybrid joined

=== GPO Configuration ===
# Open Group Policy Management Editor
# Navigate to:
* `Computer Configuration > Administrative Templates > Windows Components > MDM`
# Enable:
* '''Enable automatic MDM enrollment using default Azure AD credentials'''
# Select:
* '''Device Credential'''
* Set MDM Service to '''Intune'''

=== Post GPO Verification ===
* Login with Azure AD user
* Go to '''Settings > Accounts > Access work or school'''
* Device shows '''Connected to Intune MDM'''
* Verify in '''Microsoft Intune Admin Center > Devices'''