Category Archives: Azure AD

Do you have dual state devices in your AAD tenant?

Posted on by

We have observed recently many customers are asking why they do see the same device has two device objects on Azure AD, and connected twice to Azure AD as Azure AD Registered and Hybrid Azure AD Joined device.

In this article, I am going to describe what does dual state mean and how to get rid of this state in the recommended way in the following points:

Continue reading →

Increase productivity and protection by connecting devices to AAD and configuring Device-based Conditional Access Policy

Posted on by

The number of users working from home (WFH) increases in response of COVID-19 (aka. coronavirus) outbreak, and we need to make sure that identities and their information remain protected and secured by connecting devices to Azure AD and configuring Device-based Conditional Access Policy.

Previously, I shared an article that answers Do I really need to connect my device to Azure AD?! and in this article we will discuss how to configure device-based Conditional Access Policies.

When configuring Device-based Conditional Access Policy, customer falls into one of the following scenarios:

Continue reading →

Hybrid Azure AD Device Registration

Posted on by

In this article, I am discussing device registration for hybrid Azure AD joined devices.

First of all, let’s go through device registration steps:

  1. The device tries to retrieve tenant id and domain name from registry [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD].
  2. If it fails, the device communicates with Local AD (config partition) to get the tenant’s information form Service Connection Point (SCP). You can get SCP information using Device Registration Troubleshooter Tool PowerShell.
  3. Then, the device tries to communicate with Microsoft resources under the system context. You can verify if the device can access Microsoft resources under the system account by using the Test Device Registration Connectivity script.
  4. The device authenticates against either Azure AD or federation service (e.g. ADFS).
  5. The device registration process finishes.

Continue reading →

Azure PRT Login Status Report

Posted on by

When the user login successfully to Hybrid Azure AD device or Azure AD joined device, he acquires AzureAD PRT which is extremely important to enable Single Sign-on (SSO) and to pass Azure AD Conditional Access Policies that deals with “Hybrid Azure AD” and/or “Complaint” devices.

Azure AD PRT can be validated by running “dsregcmd /status” command as the logged on user. But coming form the fact that it is not an easy process to verify the AzureAD PRT for a huge number of users on their devices as the verification should happen under the user account.
Continue reading →

Azure AD Device Cleanup

Posted on by

When dealing with Azure AD devices, usually we are facing the following challenges:

  • There is no report in Azure AD that shows the stale devices.
  • There is no retention policy to delete the stale devices from Azure AD.
  • There is no way to restore the deleted Azure AD device or its attributes (e.g Bit-Locker recovery key).

In this article, I am providing the following PowerShell script that gives comprehensive options to deal with the above challenges.
Continue reading →