Intune Enrollment with Azure Hybrid AD not funtioning.

Question

question

EricElkmann-5310 asked Aug 3, '20 vipulsparsh-MSFT commented Aug 6, '20

Intune Enrollment with Azure Hybrid AD not funtioning.

I am attempting to do some testing with Intune but so far have not even been able to get a single device to enroll properly.

I have followed the steps below to automatically enroll all Azure AD devices with Intune MDM but that does not seem to be happening.

https://docs.microsoft.com/en-us/microsoft-365/business/manage-windows-devices?view=o365-worldwide

The devices show up in Azure Active Directory admin center under Devices with a status of Hybrid Azure AD joined but the MDM status as None.

I cannot for the life of me figure out why it is not getting the MDM properly.

MDM scope is set to All
Users have Intune license applied
The GPO has been setup for automatic MDM enrollment
The device shows up under the user in Microsoft Endpoint Manager Admin center

What am I missing?

mem-intune-enrollment azure-ad-hybrid-identity

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2020-08-04T02:16:48.18Z

CiciWu-MSFT answered Aug 4, '20

Please double confirm if the following requirements have met:

• AD-joined PC running Windows 10, version 1709 or later
• The enterprise has configured a mobile device management (MDM) service
• The enterprise AD must be registered with Azure Active Directory (Azure AD)
• The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with error 0x80180026)
• The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See How to plan your hybrid Azure Active Directory join implementation for more information.

Also, how about using group policy to enroll hybrid AD joined device? It is recommended by Intune. Here is the steps:
https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

If the methods still doesn’t help, investigate the log file if you have issues even after performing all the mandatory verification steps to see if there is any error message.
https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy#troubleshoot-auto-enrollment-of-devices

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2020-08-04T08:56:53.67Z

vipulsparsh-MSFT answered Aug 4, '20 vipulsparsh-MSFT commented Aug 6, '20

@EricElkmann-5310 I was recently engaged in an investigation around a similar scenario. If you confirm that the device is getting Hybrid AAD join and not just Intune enrolled, you need to start looking here first in order to track down, whats happening :

Check for these event logs :

Check for any Auto Enroll failure logs and share those.
Also share the output for dsregcmd /status from that machine.

If required we can take a look at that machine to figure out what is happening if the above two things dont help much. Let us know if you have any questions.

If the suggested response helped you resolve your issue, do click on "Mark as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.

event-logs.jpg (107.5 KiB)

dsregcmd.jpg (10.8 KiB)

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

vipulsparsh-MSFT · Aug 05, 2020 at 04:24 AM

@EricElkmann-5310 Following up to see if you got a chance to try those steps and see if there is any error. One important thing here is to also make sure you are logging into that machine with a user's UPN which has a routable and verified domain.

0 ·

vipulsparsh-MSFT vipulsparsh-MSFT · Aug 06, 2020 at 09:47 AM

@EricElkmann-5310 I wanted to follow up and know if the above response helped in answering your query. If it did, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.

0 ·

question