Lab 16: Hybrid Entra Join and Intune Enrolment

Overview

In this lab, I extended the endpoint management pilot from the cloud-native device in Lab 15 to an existing on-premises domain-joined Windows client. CL1 represented a traditional corporate workstation already joined to corp.nietz.co.uk.

Before configuring Hybrid Join, I found and removed an old Microsoft Entra registered workplace state for CL1. I then moved the on-premises computer object into the Hybrid Pilot device OU, configured the Hybrid Join service connection point through Microsoft Entra Connect, and used Group Policy to trigger automatic Intune enrolment.

Objective

The objective was to prove that an existing on-premises domain-joined Windows device can be brought under Microsoft Entra ID and Microsoft Intune management without rebuilding it as a cloud-native device.

Environment

Configuration

1. CL1 Starting State Reviewed

I signed in to CL1 as Emily Wilson and reviewed the local device registration state using dsregcmd /status.

Context: The pre-check showed that CL1 was domain joined but not hybrid joined. The existing workplace registration explained why an old Entra registered record existed.

2. Existing Entra Registered Record Identified

I searched Microsoft Entra ID for CL1 and confirmed that the device existed only as a Microsoft Entra registered device owned by Emily Wilson, with no Intune management.

Context: A Microsoft Entra registered device is not the same as a hybrid joined and Intune-managed corporate endpoint.

3. Workplace Registration Removed from CL1

I removed the work or school account registration from CL1 and rechecked the local device state.

Context: This cleared the user-driven workplace registration before creating the proper hybrid joined device record.

4. Stale Entra Device Record Deleted

I deleted the stale Microsoft Entra registered CL1 device record and confirmed that CL1 no longer appeared in the Entra device search.

Context: Removing the stale cloud record prevented confusion between an old registered device and the new hybrid joined device object.

5. CL1 Computer Object Confirmed in Active Directory

I confirmed that CL1 still existed as an on-premises Active Directory computer object before moving it into the pilot device OU.

Context: Hybrid Join and GPO targeting depend on the on-premises AD computer object, not only the cloud device record.

6. CL1 Moved to the Hybrid Pilot Devices OU

I moved the CL1 computer object into the dedicated Hybrid Pilot Devices OU.

Context: The pilot OU gave a controlled rollout boundary for hybrid device configuration and Intune enrolment policy.

7. Hybrid Join Device Type Selected

On SYNC1, I used Microsoft Entra Connect to configure Hybrid Microsoft Entra ID Join for Windows 10 or later domain-joined devices.

Context: CL1 is a modern Windows client, so the Windows 10 or later Hybrid Join option was the correct path.

8. Hybrid Join SCP Configured

I configured the service connection point for the corp.nietz.co.uk forest using the on-premises enterprise administrator credential.

Context: The SCP allows domain-joined Windows clients to discover the correct Microsoft Entra tenant for Hybrid Join registration.

9. Hybrid Join Configuration Completed

I completed the Microsoft Entra Connect wizard and confirmed that the Hybrid Join configuration task completed successfully.

Context: The wizard also displayed a TPM hardening recommendation for SYNC1. This was noted as a later server hardening task and did not block Hybrid Join configuration.

10. AD Connect Delta Sync Completed

I ran a delta synchronization from SYNC1 after configuring Hybrid Join.

Context: A delta sync pushed the pilot device and configuration state through the existing Entra Connect synchronisation path.

11. CL1 Hybrid Join Confirmed Locally

I checked CL1 again with dsregcmd /status and confirmed that it was both domain joined and Microsoft Entra joined.

Context: Hybrid Join is confirmed when a domain-joined client reports both AzureAdJoined : YES and DomainJoined : YES.

12. Entra Hybrid Joined Device Record Confirmed

I searched Microsoft Entra ID and confirmed that CL1 now appeared as a Microsoft Entra hybrid joined device.

Context: At this stage Hybrid Join was complete, but Intune enrolment had not yet been triggered.

13. Emily Wilson Confirmed in Intune Pilot Group

I confirmed that Emily Wilson was a member of GRP_Intune_Pilot, the group used for Intune automatic enrolment scope.

Context: The signed-in user must be in the targeted MDM enrolment scope for user credential-based automatic enrolment.

14. Emily Wilson Licence Confirmed

I confirmed that Emily Wilson had Microsoft 365 Business Premium assigned.

Context: Emily required an Intune-capable licence for automatic device enrolment and management.

15. Intune Auto-Enrolment GPO Configured

I configured a Group Policy setting to enable automatic MDM enrolment using the default Microsoft Entra credentials.

Context: The policy instructs hybrid joined Windows clients to enrol into Intune using the signed-in user's Entra credentials.

16. Intune Auto-Enrolment GPO Linked

I linked GPO_Intune_Auto_Enrollment_Hybrid_Pilot to the Hybrid Pilot Devices OU where CL1 was located.

Context: Linking the GPO to the pilot OU ensures the setting applies to CL1 without applying it to every domain computer.

17. CL1 Group Policy Application Validated

I updated Group Policy on CL1 and confirmed that the Intune auto-enrolment GPO applied to the computer object.

Context: This confirms that policy targeting worked from the client side, not just that the GPO existed in Group Policy Management.

18. CL1 MDM Enrolment State Confirmed Locally

After restart and user sign-in, I checked dsregcmd /status and confirmed that CL1 had populated Intune MDM URLs and an Azure AD PRT.

Context: Populated MDM URLs confirm that the device discovered Intune as the configured MDM provider for enrolment.

19. CL1 Confirmed in Intune Windows Devices

I reviewed the Intune Windows devices list and confirmed that CL1 was managed by Intune, corporate owned, compliant, assigned to Emily Wilson and hybrid joined.

Context: This is the main Intune validation for the lab because it confirms management, ownership, compliance, primary user and join type in one view.

20. CL1 Intune Device Overview Confirmed

I opened the CL1 Intune device overview and confirmed the device badges, primary user, Intune device name, manufacturer, operating system and last check-in details.

Context: The overview provides the support-friendly endpoint summary that a helpdesk or endpoint administrator would use during investigation.

21. Entra Device Record Updated with Intune Management

I returned to Microsoft Entra ID and confirmed that the CL1 device record now showed Emily Wilson as the owner, Microsoft Intune as the MDM provider and a compliant state.

Context: This closes the loop by showing that Microsoft Entra ID now reflects the hybrid joined device as Intune managed.

Validation

The lab was validated when CL1 showed AzureAdJoined : YES and DomainJoined : YES locally, Microsoft Entra ID showed the device as Microsoft Entra hybrid joined, the Intune automatic enrolment GPO applied to the CL1 computer object, dsregcmd showed populated MDM URLs and AzureAdPrt : YES, and Intune showed CL1 as managed, corporate owned, compliant and assigned to Emily Wilson.

Custom Windows compliance policy design was intentionally handled in Lab 17 so the Hybrid Join and enrolment evidence remained separate from the compliance-policy rollout. The Entra Connect TPM hardening recommendation for SYNC1 was also noted for a later server hardening task.

Key Technical Outcomes

This lab demonstrated stale device registration cleanup, controlled Hybrid Entra Join rollout, SCP configuration through Entra Connect, AD Connect delta sync validation, OU-based Group Policy targeting, automatic MDM enrolment, Azure AD PRT validation and tenant-side Entra and Intune verification.

The final result is that Nietz Ltd now has two endpoint baselines: CL2 from Lab 15 as a cloud-native Microsoft Entra joined device, and CL1 as an existing domain-joined device brought under Microsoft Entra ID and Intune management.