What is Hybrid Azure AD Join and how does it work in hybrid environments?

When a company already has an on-premises Active Directory (AD) environment set up and begins to migrate to the cloud with Microsoft 365 and Microsoft Entra ID (formerly Azure AD), the big question quickly arises: how do I integrate my Windows computers with the cloud without losing what I already have set up locally? Here's a guide to joining computers to Azure AD and Microsoft Entra ID.

Instead of having to choose between a fully on-premises or fully cloud-based model, hybrid join allows a single device to be joined to a traditional Windows Server AD domain and simultaneously registered with Microsoft Entra ID . This brings the best of both worlds: Group Policy, Kerberos, and on-premises applications, along with SSO to cloud services, conditional access, and modern features like Windows Hello for Business.

What exactly is Hybrid Azure AD Join?

Hybrid Azure AD Join is a model in which Windows devices are simultaneously joined to an on-premises Windows Server Active Directory domain and a Microsoft Entra ID . The same computer is part of the on-premises domain and is also registered as a cloud device.

In practice, we're talking about devices that remain classic "domain-joined" devices , with a team account in Active Directory, but which also automatically enroll in Entra ID. Login is still performed by a corporate domain account , not a native cloud user, thus maintaining the traditional authentication model.

This approach is designed for organizations that already have Windows Server AD infrastructure and need to leverage cloud capabilities (SSO to Microsoft 365, conditional access, modern management, etc.) without dismantling their on-premises environment. It is especially useful when moving to the cloud but still maintaining many on-premises dependencies.

There's a crucial point: hybrid devices need regular line of sight to the domain controllers . Without that connectivity to the local domain, over time the devices can become unusable for user login, because they continue to rely on Active Directory security and local password policies.

Key features of the Hybrid Azure AD Join device

A device hybridly joined to Microsoft Entra is characterized by being linked to both Windows Server Active Directory and Microsoft Entra ID . To log in, an organizational (domain) account is required , so the user continues to log in with their usual credentials, integrated into AD DS.

The target audience for this type of integration is organizations with hybrid environments that maintain their on-premises Active Directory infrastructure but also want to use cloud services integrated with Entra ID. This integration applies to all users in the organization on compatible devices that have been configured for it.

Regarding ownership, these devices are considered company equipment , not BYOD. This is crucial when defining conditional access policies that distinguish between corporate and personal devices, as Hybrid Azure AD Join is one of the clearest mechanisms for identifying that a Windows machine is truly corporate.

In terms of operating systems, hybrid integration is supported on Windows 11 and Windows 10 (except Home editions) and on Windows Server 2016, 2019, and 2022. It is not intended for home computers, but rather for IT-managed professional environments.

Methods of supplying and joining devices

The deployment of hybrid devices can be done in several ways, depending on the organization's deployment method. One of the most common options is for the IT department to join the device to a domain (traditional method) and then configure automatic joining to Microsoft Entra via Microsoft Entra Connect or through an AD FS configuration.

Another, more modern alternative is to use Windows Autopilot to join the device to the domain during the initial provisioning process. After joining the domain, Autopilot can automatically trigger the registration of the device in Entra ID as a hybrid, again with the help of Entra Connect or a federated environment such as AD FS.

In advanced scenarios, such as Citrix DaaS , the platform can manage the hybrid join process itself, provided it has the appropriate permissions (for example, write permission to the userCertificate attribute in the domain). In these cases, the creation of hybrid-joined machines to Microsoft Entra is integrated with provisioning technologies such as Machine Creation Services (MCS) , in both persistent and non-persistent deployments.

It's important to note that in some special deployments (for example, Autopilot using Cloud-Device-Join keys instead of SCP), the exact timing of applying these keys is critical. If they are applied too late in the provisioning process, the device may end up being only Entra Joined instead of Hybrid Joined , generating errors such as the classic "Joining the organization's network (0x800705b4)."

Login options, administration, and main features

In a Hybrid Azure AD Joined team, users authenticate with their domain organizational accounts using either a traditional password or passwordless options such as Windows Hello for Business or FIDO2 security keys . The user receives both their local Kerberos ticket and an Azure AD user token.

For administration, Group Policy Objects (GPOs) can still be used to control computer configurations, which is essential if a significant investment has already been made in templates and policies. Furthermore, it's possible to combine Configuration Manager (SCCM) with Microsoft Intune in a unified management model, leveraging modern capabilities such as application management, compliance, and data protection.

Among the most powerful features of the hybrid join are single sign-on (SSO) to cloud and on-premises resources. The user receives, on the one hand, a Kerberos ticket to access on-premises resources and, on the other hand, an Azure AD token (Primary Refresh Token or PRT) to access Exchange Online, Teams, SharePoint Online, and integrated SaaS applications.

Furthermore, the hybrid union allows for device-based conditional access , so rules can be created that require, for example, that the device be corporate and compliant in order to access sensitive data in Microsoft 365. Features such as self-service password reset (SSPR) and Windows Hello PIN reset are also enabled directly from the lock screen, provided the environment meets UPN and synchronization requirements.

When does it make sense to use Hybrid Azure AD Join devices

Hybrid join is especially suitable when an organization wants to continue using Group Policy for computer configuration. If GPOs remain central to security, browser settings, system hardening, and so on, Hybrid Azure AD Join is a perfect fit.

It's also very useful when you want to continue leveraging existing imaging solutions for deploying and configuring devices. Many companies have mature processes based on master images, scripts, and tools like MDT or SCCM, and they don't want to change them overnight.

Another typical scenario is when you have Win32 applications installed on computers that rely on machine authentication in Active Directory . These applications often require the device to be a classic domain computer, with SPNs, LDAP, Kerberos, and the trust inherent in an on-premises environment.

At the opposite extreme, if the organization aims to minimize dependence on the on-premises environment and does not want to maintain the requirement of frequent connectivity to domain controllers, a purely Azure AD Joined + Intune model may be more appropriate than a Hybrid Join.

Prerequisites, connectivity, and supported versions

To implement Hybrid Azure AD Join, some basic prerequisites are needed . First, you need to have Microsoft Entra Connect (Azure AD Connect) in a compatible version, usually 1.1.819.0 or later, configured to synchronize the default device attributes and the organizational units (OUs) that contain the computer objects you want to register.

Hybrid identity administrator credentials are also required in the Microsoft Entra tenant, as well as enterprise administrator credentials in each involved Active Directory Domain Services forest. In federated environments, an AD FS is also required, at least on Windows Server 2012 R2 , with WS-Trust endpoints enabled.

At the network level, devices must have access to a number of Microsoft endpoints , such as enterpriseregistration.windows.net , login.microsoftonline.com , device.login.microsoftonline.com , and, if using direct SSO, autologon.microsoftazuread-sso.com . In Azure Government environments, specific domains (.us) are used for these same functions.

If your organization uses an outbound proxy , it's important that Windows computers can authenticate correctly to that proxy under the computer context , since device registration runs under the system account. You can use WPAD or configure the WinHTTP proxy via Group Policy (GPO) starting with Windows 10 version 1709 to facilitate this process.

Compatibility, unsupported scenarios, and image considerations

Although Hybrid Azure AD Join supports a wide range of Windows versions, there are explicitly unsupported scenarios . For example, it is not compatible with Windows Server acting as a domain controller (DC) . It also does not work with Server Core for device registration, nor with the User State Migration Tool (USMT) applied directly to the registration process.

Regarding image creation, there are important recommendations: if you use Sysprep with an image older than Windows 10 1809, you must ensure that the image does not come from a device that was already registered in Entra ID as a hybrid , to avoid duplicates and corrupted device states.

A similar issue arises when using virtual machine snapshots to deploy more VMs: the snapshot must not originate from a VM already registered in Entra as a hybrid. Otherwise, each cloned VM will inherit an incorrect registration status, causing multiple device identity problems.

In environments with technologies like Unified Write Filter or other solutions that clean the disk on every reboot, these should only be applied after the hybrid join is complete . If enabled before the hybrid join process finishes, the computer may become unregistered on every boot because the device registry changes never persist.

Device states, double registration, and cleaning

It's possible that Windows 10 or later devices, joined to a domain, are already registered with a Microsoft Entra ID independently before enabling hybrid join. In this scenario, a dual state can occur , where the same device appears as Hybrid Azure AD Joined and, at the same time, as Azure AD Registered for certain users.

To minimize this issue, it is recommended to upgrade to Windows 10 version 1803 (with KB4489894) or later . Starting with these versions, the system itself handles the dual state cleanup: once the computer completes the Hybrid Join and the same user logs in, the previous Azure AD Registered account for that user is automatically removed.

In versions prior to 1803, the cleanup must be done manually by removing the registered status from Entra before enabling Hybrid Join. Starting with version 1803, Windows also unenrolls in Intune or other MDM services if that enrollment depended directly on Entra registration resulting from the "Registered" status.

It's important to understand that this automated process only affects domain accounts . Local accounts with an Entra registration will retain it, as they are not included in the same cleanup flow. Additionally, if you want to completely prevent a domain computer from registering as Azure AD Registered, you can use the BlockAADWorkplaceJoin registry key in HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin with a dword value of 1.

A single forest and multiple Microsoft tenants. Enter

In organizations with a single Active Directory forest but multiple Microsoft Entra tenants, hybrid join becomes more complex. To properly register devices in each tenant, the Service Connection Point (SCP) must be configured at the device level , not at the AD forest level, so that each device knows which tenant to connect to.

This type of multi-tenant scenario requires careful planning , as certain Microsoft Entra features may not function as expected when attempting to combine multiple tenants into a single on-premises forest. It is recommended to follow specific deployment guides for Hybrid Azure AD Join in multi-tenant environments.

TPM, UPN and other important technical details

Hybrid join also has dependencies and nuances related to TPM and FIPS . Hybrid Azure AD Join supports FIPS-compliant TPM 2.0 , but not FIPS-compliant TPM 1.2 . If the devices use FIPS-compliant TPM 1.2, that mode must be disabled before proceeding. This depends on the hardware manufacturer, as Microsoft does not provide specific tools for this.

Since Windows 10 version 1903, the system stops using TPM 1.2 for hybrid joins and treats those devices as if they did not have a TPM, which impacts some functionalities related to keys and advanced security.

Another critical aspect is the handling of user UPNs in Active Directory . A routable UPN is one whose domain can be validated on the internet and is added as a verified domain in the Microsoft Entra tenant (for example, contoso.org in local Active Directory and contoso.com as the primary domain in Entra, both verified). A non-routable UPN typically uses suffixes like .local , which are valid only within the internal network.

Hybrid Azure AD Join's compatibility with routable or non-routable UPNs depends on whether the environment is federated or managed and the Windows 10 version. Generally speaking: in federated environments, both routable and non-routable UPNs are supported starting with certain versions (1703/1803), while in managed environments only routable UPNs are supported . Non-routable UPNs in managed domains are not supported for hybrid join.

Managed domains, federated environments, and WS-Trust

Hybrid Azure AD Join can be deployed in both managed domains and federated environments . In a managed domain, it uses password hash synchronization (PHS) or pass-through authentication (PTA) along with transparent SSO , without the need to maintain a federation server for authentication.

In these cases, Microsoft Entra Connect offers a setup wizard that simplifies much of the work. Simply select the option to configure the hybrid join, choose the supported operating systems, define the OUs to be synchronized, and let the tool create the Service Connection Point (SCP) in the corresponding forests.

In a federated environment, the identity provider (typically AD FS ) must support the WS-Trust protocol , as this is what Windows devices use to authenticate with the Microsoft Entra service during the registration process. Enabling WS-Trust endpoints such as /adfs/services/trust/2005/windowstransport , /13/windowstransport , /2005/usernamemixed , /13/usernamemixed , /2005/certificatemixed , and /13/certificatemixed is essential.

When you configure Hybrid Azure AD Join in federated environments using Entra Connect, you specify the AD FS server as the authentication service, configure the management credentials, and enable the necessary notifications. In recent versions of Windows 10 (1803 and later), if instant hybrid join through the federation service fails, computer object synchronization via Entra Connect is used to complete the registration.

Internal process of Hybrid Azure AD Join and status check

The internal flow of a typical Hybrid Azure AD Join involves several stages. First, the device joins the Active Directory domain . Then, upon detecting the SCP, the device generates a self-signed certificate and stores it in the userCertificate attribute of the device object in AD.

Next, Microsoft Entra Connect synchronizes that device object and its userCertificate attribute to the Entra ID. This creates a device object in the cloud , which initially shows a pending registration status. At this point, the Hybrid Join is not yet complete, but the synchronization part is finished.

To complete the process, a user must log on to the computer using a domain account that is synchronized with Entra ID. During that login, while the computer has line of sight to the domain controllers, a scheduled task (such as Automatic-Device-Join ) runs that attempts to complete the cloud registration.

If everything goes well, Entra ID issues a new certificate for the device , which is stored alongside the original self-signed certificate. The device's status in the Entra ID portal changes from "pending" to a date and time of registration completion . From that moment on, the device is considered fully Hybrid Azure AD Joined, and users receive a Primary Refresh Token (PRT) to authenticate with cloud applications and services.

Diagnostic and troubleshooting tools

To check the status of a Hybrid Azure AD Joined device, one of the most useful tools is the dsregcmd command . By running dsregcmd /status in a privileged console, you can check values ​​such as AzureAdJoined (if the machine is joined to Entra), DomainJoined (if it's joined to AD), and AzurePrt (if the current user has PRT).

If AzureAdJoined is not set to "YES," or the PRT has not been issued, first check if the device object exists in Entra ID and whether its status is pending or completed. If the object is not listed, Entra Connect likely did not properly synchronize the userCertificate attribute, or the device did not correctly detect the SCP.

If the object appears in the cloud but remains in a pending state, it usually indicates that no user has logged in to the domain-connected computer , or that the automatic registration task is not running. In that case, you can manually force the process with `dsregcmd /join` or by running the task from Task Scheduler.

Another avenue for analysis is the Event Viewer event logs , especially those in the paths Application and Services > Microsoft > Windows > Workplace Join > Admin and User Device Registration > Admin . Errors here often provide clear clues about connectivity, authentication, or certificate issues.

In addition, Microsoft offers the Device Registration Troubleshooter Tool (DSRegTool) , a PowerShell script designed to review device configuration and registration status. Run with administrator privileges, this script performs automated checks and can save significant time when troubleshooting Hybrid Join processes.

This complex web of requirements, steps, and tools makes Hybrid Azure AD Join a highly flexible but also demanding solution in terms of design. When properly planned—including targeted testing with representative pilot groups, review of UPNs, SCPs, OUs, and proxies, and a clear strategy for cleaning up dual-state environments—it results in a robust device identity model that maintains the advantages of a classic domain while opening the door to modern Microsoft Entra ID capabilities.

Enabling Microsoft Entra hybrid union not only solves the fit between domain teams and cloud services, but becomes the foundation for a modern security model where corporate devices are accurately identified, benefit from full SSO, and can be subject to conditional access, without forcing the company to abruptly abandon its investments in Active Directory or its traditional way of managing Windows.