Configure Hybrid Azure AD join for managed domains

In this article, I will walk through the configuration of Microsoft Entra Hybrid Join (formerly Hybrid Azure AD Join) for Active Directory domain-joined Windows devices.

Note: Update – August 2026: This article has been updated to reflect the transition from Azure Active Directory (Azure AD) to Microsoft Entra ID, including the current Microsoft Entra Connect Sync tooling and configuration used to synchronize identities between on-premises Active Directory and Microsoft Entra ID.

Microsoft Entra Hybrid Join is not limited to Windows client operating systems. Supported Windows Server member servers can also be hybrid joined to Microsoft Entra ID.

However, Domain Controllers cannot be Microsoft Entra hybrid joined, and there are additional limitations for some Windows Server configurations such as Server Core.

Despite the wording Windows 10 or later domain-joined devices, this option also covers supported modern Windows Server operating systems such as Windows Server 2016, 2019, and 2022. The Supported Windows downlevel domain-joined devices option refers to legacy Windows versions using the older device registration mechanism.

The configuration and troubleshooting steps shown in this article therefore focus on Windows clients, although the underlying Microsoft Entra Hybrid Join concept also applies to supported Windows Server member servers.

Like a user identity in your organization, a device identity is an important identity that you want to protect. A device identity is represented by a device object in Microsoft Entra ID and can be used when making authentication, access, and configuration decisions, for example through Conditional Access.

A device can establish an identity in Microsoft Entra ID through one of the following methods:

• Microsoft Entra joined
• Microsoft Entra hybrid joined
• Microsoft Entra registered

The differences between them will be described in the following article from Microsoft.

What is a device identity?
https://learn.microsoft.com/en-us/entra/identity/devices/overview

Bringing your devices to Microsoft Entra maximizes user productivity through single sign-on (SSO) across your cloud and on-premises resources. You can secure access to your cloud and on-premises resources with Conditional Access at the same time.

You can deploy a managed environment by using password hash sync (PHS) or pass-through authentication (PTA) with seamless single sign-on. These scenarios don’t require you to configure a federation server for authentication.

Source: https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains

Configure Microsoft Entra hybrid join

To configure Microsoft Entra hybrid joine we can also use the Microsoft Entra Connect Sync tool.

First we need to be sure, that besides our synced users also the computer objects will be synced to Microsoft Entra ID.

So click on Customize synchronization options.

Under Connect Directories, add the on-premises Active Directory forest that will be synchronized with Microsoft Entra ID. In our lab, the matrixpost-lab.net Active Directory forest is already configured and successfully connected, as indicated by the green check mark.

Under Domain and OU filtering, make sure that the Organizational Units (OUs) containing the computer objects that should become Microsoft Entra hybrid joined are included in the synchronization scope.

Note: Configuring Microsoft Entra hybrid join alone is not sufficient if the corresponding computer objects are located in an OU excluded from Microsoft Entra Connect Sync. The computer objects must also be within the configured OU synchronization scope.

From the Additional tasks page in Microsoft Entra Connect Sync, we also need to select Configure device options and click Next.

This wizard is used to configure device-related scenarios, including Microsoft Entra hybrid join for our on-premises Active Directory domain-joined computers.

Click Next to continue with the configuration.

On the Device options page, select Configure Hybrid Microsoft Entra ID join. This configures our existing on-premises Active Directory domain-joined devices so they can additionally establish a device identity in Microsoft Entra ID.

Click Next to select the Active Directory forest and Windows device types that should participate in the Microsoft Entra hybrid join.

On the Device operating systems page, select Windows 10 or later domain-joined devices. Despite the wording, this option also covers supported modern Windows client and Windows Server versions, including the Windows 11 and Windows Server 2022 systems used in our lab.

The Supported Windows downlevel domain-joined devices option is only required for older Windows versions and is therefore not needed in our environment. Click Next to continue.

On the SCP configuration page, select the Active Directory forest in which Microsoft Entra Connect Sync should configure the Service Connection Point (SCP).

The SCP is stored in Active Directory and allows domain-joined Windows devices to discover the Microsoft Entra tenant information they need to initiate the Microsoft Entra hybrid join process.

Select the matrixpost-lab.net forest and click Add to provide credentials with Enterprise Admin permissions.

These permissions are required because Microsoft Entra Connect needs to create or update the Service Connection Point (SCP) in the Configuration partition of the on-premises Active Directory forest.

The Ready to configure page summarizes the changes that will be applied. In our case, Microsoft Entra Connect will configure the Service Connection Point (SCP) for device registration in the matrixpost-lab.net Active Directory forest.

Click Configure to apply the configuration. Once created, domain-joined Windows devices can use the SCP to discover the Microsoft Entra ID tenant information required to initiate their Microsoft Entra hybrid join.

The Microsoft Entra hybrid join configuration has now been completed successfully. The required Service Connection Point (SCP) is configured in our on-premises Active Directory and can be used by domain-joined devices to discover the corresponding Microsoft Entra ID tenant.

Note that this completes the Microsoft Entra Connect configuration, but the individual devices still need to perform their device registration / hybrid join process. We will verify this on our Windows devices in the following steps using dsregcmd.

We can verify the configured Service Connection Point (SCP) directly in our on-premises Active Directory using ADSI Edit. Navigate to the Configuration partition and then to CN=Services → CN=Device Registration Configuration.

The SCP’s keywords attribute contains the Microsoft Entra tenant information, including azureADName:matrixpost-lab.onmicrosoft.com and the azureADId of our tenant. Domain-joined Windows devices use this information to discover which Microsoft Entra ID tenant they should register with during the Microsoft Entra hybrid join process.

Microsoft Entra hybrid join requires devices to have access to the following Microsoft resources from inside your organization’s network:

• https://enterpriseregistration.windows.net
• https://login.microsoftonline.com
• https://device.login.microsoftonline.com
• https://autologon.microsoftazuread-sso.com (If you use or plan to use seamless SSO)
• Your organization’s Security Token Service (STS) (For federated domains)

Source: https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join#network-connectivity-requirements

To successfully complete Microsoft Entra hybrid join of your Windows downlevel devices and to avoid certificate prompts when devices authenticate to Entra ID, you can push a policy to your domain-joined devices to add the following URLs to the local intranet zone in Internet Explorer:

• https://device.login.microsoftonline.com
• Your organization’s STS (For federated domains)
• https://autologon.microsoftazuread-sso.com (For seamless SSO)

You also must enable Allow updates to status bar via script in the user’s local intranet zone.

Group policy option – Detailed steps
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start#group-policy-option—detailed-steps

Verify the registration by using dsregcmd

The dsregcmd /status command provides detailed information about the device registration, Microsoft Entra join state, tenant association, user state, and Single Sign-On (SSO) status of the local Windows device.

It is one of the primary commands for verifying and troubleshooting a Microsoft Entra hybrid joined device.

dsregcmd /status

The combination of AzureAdJoined : YES and DomainJoined : YES confirms that Win11-VM01.matrixpost-lab.net is both joined to our on-premises Active Directory domain and registered with Microsoft Entra ID.

Additionally, DeviceAuthStatus : SUCCESS confirms that the device object exists in Microsoft Entra ID, is enabled, and the device can successfully authenticate using its device identity.

Further down in dsregcmd /status, the SSO State shows that AzureAdPrt : YES, meaning that the signed-in user has successfully obtained a Microsoft Entra Primary Refresh Token (PRT) for Single Sign-On to Microsoft Entra resources.

CloudTgt : YES indicates that a Cloud Kerberos TGT is available, while OnPremTgt : YES confirms that the user can also obtain Kerberos authentication for on-premises Active Directory resources through Microsoft Entra Kerberos. In our case, both are available for the signed-in domain user John Doe (MATRIXPOST\jdoe).

Note: The Microsoft Entra hybrid join itself is demonstrated by AzureAdJoined : YES + DomainJoined : YES in the Device State section. The values shown here under SSO State describe the currently signed-in user’s authentication and SSO state, rather than the device join state itself.

Web Account Manager (WAM): WAM is the default authentication broker in Windows and provides applications with access to authentication tokens and Single Sign-On (SSO). It also provides a plug-in framework through which identity providers such as Microsoft Entra ID can integrate their authentication services with Windows.

In my output, WamDefaultSet : YES indicates that a default WAM account is available for the currently signed-in user, while WamDefaultAuthority : organizations and WamDefaultId : https://login.microsoft.com identify the Microsoft organizational account authority used by WAM.

The screenshot below shows how Mimikatz could access the CloudAP authentication data directly from LSASS on Windows 10 (my old testing environment running in 2021), including the user’s Primary Refresh Token (PRT) and its associated CloudAP information.

On modern Windows 11, LSA protection (RunAsPPL) is commonly enabled and prevents this direct LSASS memory access, causing Mimikatz to fail with Access Denied (0x00000005) even when SeDebugPrivilege is enabled.

Even after disabling LSA protection (RunAsPPL) on modern Windows 11, the latest official Mimikatz release (2.2.0-20220919 | post updated today August 2026) can no longer successfully enumerate the LSASS logon list in this test (second screenshot). This demonstrates how changes in newer Windows versions can break techniques that worked successfully on Windows 10 in 2021.

On Windows 11 using the latest official Mimikatz release (2.2.0-20220919), post updated today August 2026)

binaires : https://github.com/gentilkiwi/mimikatz/releases/latest
sources : https://github.com/gentilkiwi/mimikatz
présentations : http://blog.gentilkiwi.com/presentations

For troubleshooting the Microsoft Entra hybrid join process with detailed diagnostic output:

This manually triggers the device registration/join process and displays verbose debugging information.

dsregcmd /debug /join

To leave and then re-trigger the hybrid join, we also used:

dsregcmd /leave
dsregcmd /debug /join

Windows Task – Automatic-Device-Join

The task Automatic-Device-Join below is by default disabled for standalone windows 10 computers and will be enabled after domain join. Also after leaving domain it will be disabled again.

After the first successful run of this task, the computer will be Hybrid Azure AD joined and the second Task Device-Sync will be enabled. Device-Sync will synchronize device attributes with Entra ID.

In order the Automatic-Device-Join task can run successfully, the computer object from on-premises first have to be synced to Entra ID, otherwise the following error will appear after running dsregcmd /status.

The device object by the given id is not found.

Task Scheduler -> Microsoft -> Windows -> Workplace Join

In Microsoft Entra ID under Devices, you will see the synced computers from on-premises with the Join type Microsoft Entra hybrid joined, also every computer with Microsoft Entra registered and Microsoft Entra joined.

Microsoft Entra hybrid joined computers in state Pending as below, means that the device has been synchronized from on-premises to Microsoft Entra ID, and is waiting to complete the registration from the client.

Therefore the Automatic-Device-Join task on the client first needs to run to complete the registration as mentioned above.

If you are using System Center Configuration Manager (SCCM) in your network, you may also know the Client Settings Automatically register new Windows 10 domain joined devices with Azure Active.

This behavior is also the default in Windows 10, version 1709.
https://docs.microsoft.com/en-us/mem/configmgr/core/clients/deploy/deploy-clients-cmg-azure#configure-client-settings

Users must be able to join devices to Microsoft Entra ID, so switch to All or Selected and add the users who should be able to join.

Regarding System Center Configuration Manger (SCCM) and co-management with Microsoft Intune, please read my following post.

Re-register a Windows 10 device for Hybrid Azure AD join

First we need to remove the existing registration to Azure AD from the device as follow.

dsregcmd /leave
dsregcmd /debug /leave
Will display debug messages in addition

Also remove the following two certificates from the computer accounts personal store.

Sign out and sign in to trigger the scheduled task that registers the device again with Azure AD or execute the task by hand as follows:

Go to Task Scheduler > Microsoft > Windows > Workplace Join

Run the Automatic-Device-Join task

For Windows 10 Version 1607 and later Hybrid Azure AD join is invoked by a scheduled task which is by default created.

The task Automatic-Device-Join is by default disabled for standalone windows 10 computers and will be enabled after domain join.

By default will be triggered at every logon and every hour for on-premises domain joined devices.

Check that the two certificates was re-created.

Check again with dsregcmd /status if the device re-registered successfully.

MS-Organization-Access and MS-Organization-P2P-Access Certificate

Both certificates will be populated by the User Device Registration Scheduled Task on the workstation.

The MS-Organization-P2P-Access certificates are issued by Azure AD to both, Azure AD joined and hybrid Azure AD joined devices.

These certificates are used to enable trust between devices in the same tenant for remote desktop scenarios.

One certificate is issued to the device and another is issued to the user. The device certificate is present in Local – Computer – Personal – Certificates and is valid for one day. This certificate is renewed (by issuing a new certificate) if the device is still active in Microsoft Entra ID.

The user certificate is present in Current User – Personal – Certificates and this certificate is also valid for one day, but it is issued on-demand when a user attempts a remote desktop session to another Microsoft Entra joined device. It is not renewed on expiry. Both these certificates are issued using the MS-Organization-P2P-Access certificate present in the Local Computer – AAD Token Issuer – Certificates. This certificate is issued by Microsoft Entra ID during device registration.

Source: https://docs.microsoft.com/en-us/azure/active-directory/devices/faq#what-are-the-ms-organization-p2p-access-certificates-present-on-our-windows-10-devices

The following service principal below will be automatically registered after a windows device has been successfully joined to Microsoft Entra ID. (Microsoft Entra joined and Microsoft Entra hybrid joined devices)

Using this principal, Windows devices that are Microsoft Entra joined will provision device certificates in their computer store with a name matching “MS-Organization-P2P-Access” that enables RDP using Microsoft Entra ID credentials. Via PKI, these certificates trust the tenant root certificate that is registered on the “P2P Server” service principal in Microsoft Entra ID.

Source: https://www.jasonfritts.me/tag/ms-organization-p2p-access/

Troubleshooting

The first tool to check if you encounter some issues regarding Hybrid Azure AD join is the command line tool dsregcmd.

Troubleshooting devices using the dsregcmd command
https://docs.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-device-dsregcmd

Azure Active Directory device management FAQ
https://docs.microsoft.com/en-us/azure/active-directory/devices/faq

Yo can check the status with

dsregcmd /status

Here I can saw that something went wrong and the computer wasn’t joined to Azure AD.

Therefore I checked the windows logs for the User Device Registration.

Event Viewer -> Microsoft -> Windows -> User Device Registration

Automatic registration failed at join phase.
Exit code: Unknown HResult Error code: 0x801c001d
errorPhase: discover
Source: User Device Registration
Event ID: 304
User: SYSTEM

Automatic registration failed. Failed to lookup the registration service information from Active Directory. Exit code: Unknown HResult Error code: 0x801c001d.

The reason for is, that in my lab environment, I will first need to configure Hybrid Azure AD join, which will create a Service Connection Point (SCP), which the devices needs to discover the Azure AD tenant information.

Beginning with version 1.1.819.0, Azure AD Connect includes a wizard that you can use to configure hybrid Azure AD join. The wizard significantly simplifies the configuration process. The related wizard:

• Configures the service connection points (SCPs) for device registration
• Backs up your existing Azure AD relying party trust

Links

Configure hybrid Azure AD join
https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-federated-domains#configure-hybrid-azure-ad-join

Troubleshooting hybrid Azure Active Directory joined devices
https://docs.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current

Troubleshooting devices using the dsregcmd command
https://docs.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-device-dsregcmd