Do you have dual state devices in your AAD tenant?

We have observed recently many customers are asking why they do see the same device has two device objects on Azure AD, and connected twice to Azure AD as Azure AD Registered and Hybrid Azure AD Joined device.

In this article, I am going to describe what does dual state mean and how to get rid of this state in the recommended way in the following points:

Continue reading

Configure hybrid Azure Active Directory join for remote users

The number of users working from home (WFH) increases in the response of COVID-19 (aka. coronavirus) outbreak, and we need to make sure that identities and their information remain protected and secured by connecting devices to Azure AD and configuring Device-based Conditional Access Policy.

Previously, I shared an article and discussed how to Increase productivity and protection by connecting devices to AAD and configuring Device-based Conditional Access Policy

We are receiving lots of queries from customers who are facing challenges in configuring Hybrid Azure AD joined for the remote domain-joined device where users are working from home.

In this article,  we will discuss one of the most repeated challenges, which is connecting remote domain-joined devices to Azure AD as Hybrid Azure AD Joined devices. Also, we will make it more transparent to deal with this challenge to reach out to our needs.

Continue reading

Increase productivity and protection by connecting devices to AAD and configuring Device-based Conditional Access Policy

The number of users working from home (WFH) increases in response of COVID-19 (aka. coronavirus) outbreak, and we need to make sure that identities and their information remain protected and secured by connecting devices to Azure AD and configuring Device-based Conditional Access Policy.

Previously, I shared an article that answers Do I really need to connect my device to Azure AD?! and in this article we will discuss how to configure device-based Conditional Access Policies.

When configuring Device-based Conditional Access Policy, customer falls into one of the following scenarios:

Continue reading

Hybrid Azure AD Device Registration

In this article, I am discussing device registration for hybrid Azure AD joined devices.

First of all, let’s go through device registration steps:

  1. The device tries to retrieve tenant id and domain name from registry [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD].
  2. If it fails, the device communicates with Local AD (config partition) to get the tenant’s information form Service Connection Point (SCP). You can get SCP information using Device Registration Troubleshooter Tool PowerShell.
  3. Then, the device tries to communicate with Microsoft resources under the system context. You can verify if the device can access Microsoft resources under the system account by using the Test Device Registration Connectivity script.
  4. The device authenticates against either Azure AD or federation service (e.g. ADFS).
  5. The device registration process finishes.

Continue reading

Do I really need to connect my device to Azure AD?!

Lots of customers are asking if it is important to connect their devices to Azure AD, and what are the benefits of doing this.

Before answering this question, lets discuss first some of the benefits from end users, IT admins and security perspectives that will be gained when connecting devices to Azure AD.
Continue reading

Azure PRT Login Status Report

When the user login successfully to Hybrid Azure AD device or Azure AD joined device, he acquires AzureAD PRT which is extremely important to enable Single Sign-on (SSO) and to pass Azure AD Conditional Access Policies that deals with “Hybrid Azure AD” and/or “Complaint” devices.

Azure AD PRT can be validated by running “dsregcmd /status” command as the logged on user. But coming form the fact that it is not an easy process to verify the AzureAD PRT for a huge number of users on their devices as the verification should happen under the user account.
Continue reading