Enable domain-joined Windows 10 devices to be managed by Microsoft 365 Business

If your organization uses Windows Server Active Directory on-premises, you can set up Microsoft 365 Business to protect your Windows 10 devices, while still maintaining access to on-premises resources that require local authentication. You can set this up by first synchronizing your Active Directory with Azure Active Directory, followed by registering the Windows 10 devices with Azure AD and enrolling them for mobile device management by Microsoft 365 Business.

Set up domain-joined devices to be managed by Microsoft 365 Business

To set up your organization's domain-joined devices to benefit from the capabilities provided by Azure Active Directory in addition to on-premises Active Directory, you can implement Hybrid Azure AD joined devices. These are devices that are joined both to your on-premises Active Directory and your Azure Active Directory. Hybrid Azure AD joined devices can be protected and managed by Microsoft 365 Business.

Complete the steps below to make your Windows 10 devices Hybrid Azure AD joined and managed by Microsoft 365 Business.

  1. To synchronize your users, groups and contacts from local Active Directory into Azure Active Directory, run the Directory synchronization wizard and Azure Active Directory Connect as described in Set up directory synchronization for Office 365.


    The steps are exactly the same for Microsoft 365 Business.

  2. Before you complete step 3 to enable Windows 10 devices to be Hybrid Azure AD joined, you need to make sure that you meet the following prerequisites:

    • You are running the latest version of Azure AD connect.

    • Azure AD connect has synchronized all the computer objects of the devices you want to be hybrid Azure AD joined. If the computer objects belong to specific organizational units (OU), then make sure these OUs are set for synchronization in Azure AD connect as well.

  3. Register existing domain-joined Windows 10 devices to be hybrid Azure AD Joined and enroll them for mobile device management by Intune (Microsoft 365 Business):

  4. Follow the step by step instructions in How to configure hybrid Azure Active Directory joined devices. This will enable the synchronization of your on-premises Active Directory joined Windows 10 computers and make them cloud ready.

  5. In order to enroll a Windows 10 device for mobile device management, see Enroll a Windows 10 device with Intune by using a Group Policy for instructions. You can set the Group Policy at a local computer level or for bulk operations, you can create this group policy setting on your domain controller server.