Onboard Hybrid Azure AD Joined Devices to Intune

Summary

This video provides a comprehensive guide on onboarding Hybrid Azure AD Join devices to Intune. It explores the prerequisites, such as device OS requirements and licensing, and walks through the process of using a group policy object for automatic MDM enrollment. The video highlights the benefits of Intune, including cloud-based management, scalability, and remote device patching. Additionally, it covers troubleshooting techniques, including checking task scheduler logs and event viewer for errors. This solution allows enterprises to effectively manage devices, enforce security policies, and deploy updates, all without needing on-premises infrastructure.

Takeaways

• 😀 Hybrid Azure AD Join devices can be onboarded to Intune for better management and security.
• 😀 The goal of this feature is to enable device management without requiring on-premises connectivity.
• 😀 Intune offers cloud-based management, ensuring regular updates and patches regardless of user location.
• 😀 Prerequisites for onboarding devices include Windows 10 version 1709 or higher, Intune licenses, and proper scoping of users.
• 😀 The GPO configuration for automatic MDM enrollment requires enabling Azure AD credentials for enrollment.
• 😀 Devices enrolled to Intune can be managed with device compliance policies, app deployments, and MDM capabilities.
• 😀 Onboarding Hybrid Azure AD Join devices eliminates the need for on-prem infrastructure like SCCM for device management.
• 😀 Intune's cloud-based solution provides a scalable and flexible way to manage devices across remote locations.
• 😀 Benefits of using Intune include seamless patching, OS updates, and application deployment for enrolled devices.
• 😀 Troubleshooting device enrollment involves verifying group policy application, checking task scheduler logs, and using Event Viewer for errors.
• 😀 A non-working machine will not show the 'Info' button in the 'Access Work or School' settings, indicating it's not MDM-enrolled.

Q & A

What is the purpose of onboarding hybrid Azure AD join devices to Intune?

Onboarding hybrid Azure AD join devices to Intune allows for seamless device management, ensuring that updates, patches, policies, and applications can be deployed regardless of the user's location, including remote work environments.

What are the key prerequisites for onboarding hybrid Azure AD join devices to Intune?

The key prerequisites include having Windows 10 devices on version 1709 or higher, users must be licensed for Intune, and the devices must have a valid Primary Refresh Token (PRT) to ensure proper functionality in a hybrid environment.

What is a Group Policy Object (GPO) and why is it important in this process?

A Group Policy Object (GPO) is a configuration tool in Active Directory that can automate tasks on machines. In this process, it is used to enable automatic MDM enrollment using Azure AD credentials, allowing the hybrid devices to be onboarded to Intune.

How does the device enrollment process work once the GPO is applied?

Once the GPO is applied, a task is created on the device to automatically enroll it into Intune. This task ensures the machine is onboarded without user interaction, allowing for further management through Intune.

What does MDM stand for and what role does it play in this context?

MDM stands for Mobile Device Management. In this context, it refers to the management and enrollment of devices in Intune, allowing administrators to enforce policies, deploy applications, and ensure compliance for hybrid Azure AD join devices.

What are the benefits of using Intune to manage hybrid Azure AD join devices?

The benefits include no user interaction required for device enrollment, mass enrollment via GPO, the ability to apply policies, updates, and deploy applications remotely, and preventing standard users from unrolling devices from Intune.

What steps should be followed if the device does not successfully enroll into Intune?

If the device does not enroll successfully, administrators should check the event viewer for errors, ensure the GPO is correctly applied, and verify that the necessary task is created in the task scheduler on the device.

What is the significance of the 'info' button in the device settings on enrolled devices?

The 'info' button in the device settings appears only if the device is successfully enrolled in Intune. It allows users to trigger sync and check diagnostic information related to the device's enrollment status.

What difference does it make if a device is not scoped for the GPO in terms of user experience?

If a device is not scoped for the GPO, it will not show the 'info' button in the settings, indicating that it is not enrolled in Intune. This also means the device will not receive the benefits of MDM management such as updates, policies, and application deployments.

How can an administrator verify that a device is correctly enrolled in Intune from the Microsoft Endpoint Manager?

An administrator can verify enrollment by checking the device's status in the Microsoft Endpoint Manager portal. The device should appear in the list as MDM compliant, and its Azure AD join status should also be displayed as hybrid Azure AD joined.