Week 6, Day 1 — Entra ID Connect & Hybrid Azure AD Join

Week 5 close & the endpoint gap

• Ask: "You have MFA, CA policies, SharePoint permissions, and Teams governance all configured. What can a legitimate user with valid MFA credentials do on a device that is compromised, has no encryption, and hasn't been patched in 6 months?" — answer: everything. Credential-based controls don't care about device state. Endpoint management is the missing layer.
• Frame the week: Weeks 1–5 secured the identity and the data. Week 6 secures the device the identity signs in from. Without it, a perfectly configured M365 tenant can be accessed from any endpoint — including malware-infected personal laptops.

Hybrid identity architecture — on-prem AD, Entra ID, and the bridge between them

This is the most common real-world M365 deployment model. Most organisations have existing on-prem AD infrastructure they cannot simply abandon — hybrid identity lets them extend that identity into the cloud without replacing it.

The three device join states

The hybrid join pipeline — what needs to happen

• Entra ID Connect — a service installed on the domain controller (or a dedicated sync server) that synchronises on-prem AD objects (users, groups, devices) to Entra ID. It runs on a schedule (default: every 30 minutes) and can be triggered manually. Express Settings handles the most common configuration — password hash sync, hybrid join, device writeback — in a single installer flow. This is what students install today.
• Password hash sync vs pass-through auth vs federation — three ways Connect can handle authentication. Password hash sync (PHS) copies a hash of the on-prem password to Entra ID — simplest, most resilient, recommended for most deployments. Pass-through auth (PTA) authenticates against the on-prem AD in real time — no hash stored in the cloud. Federation (ADFS) redirects authentication entirely to on-prem — most complex, rarely needed for new deployments. Express Settings uses PHS.
• MDM auto-enrollment — a Group Policy setting that instructs domain-joined Windows 10/11 machines to automatically register with the Intune MDM service. No user interaction required. The GPO sets the MDM service URL (Intune) and triggers the enrollment silently in the background after gpupdate /force.
• dsregcmd — the diagnostic tool — dsregcmd /status shows the complete join state of a Windows machine. The three fields to check after hybrid join: AzureAdJoined : YES (registered with Entra ID), DomainJoined : YES (still in on-prem AD), WorkplaceJoined : NO (not just a personal device registration — a full hybrid join). If WorkplaceJoined is YES and AzureAdJoined is NO, the enrollment triggered as a personal device registration instead of a hybrid join — recheck the GPO and sync.
• The Intune portal — intune.microsoft.com (also reachable via Microsoft Endpoint Manager admin centre). After hybrid join, WIN-CLIENT-01 appears in Devices → All devices with Join type = Hybrid Azure AD joined. This is the management plane for all enrolled devices — compliance state, configuration profiles, app inventory, remote actions.

Lab 6-A: Installing Entra ID Connect and hybrid-joining WIN-CLIENT-01

This is the largest single lab of the course — 10 sequential phases building the complete hybrid identity infrastructure from scratch. Each phase must succeed before the next begins. Work carefully and record every result.

• Phase 1 — DC-01 pre-flight (5 min)
  On DC-01, open an elevated Command Prompt and run: dcdiag /test:dns
  All tests should pass. If any fail, resolve before proceeding — Connect installation requires functioning DNS.
  Also verify: net user shows the Lakeview Logistics user accounts (Sarah Chen etc.) exist in AD.
  Verify internet: ping microsoft.com from DC-01 resolves and responds.
• Phase 2 — Download Entra ID Connect (5 min)
  On DC-01, open a browser and navigate to: https://www.microsoft.com/en-us/download/details.aspx?id=47594
  Download AzureADConnect.msi. Save to the Desktop.
  While downloading: navigate to entra.microsoft.com → Identity → Hybrid management → Entra Connect and record what the portal shows before any sync is configured.
• Phase 3 — Install Entra ID Connect (15 min)
  Run AzureADConnect.msi as administrator. Accept the licence.
  Choose Use express settings.
  When prompted for Azure AD credentials: sign in with your M365 Global Admin account (admin@[yoursubdomain]).
  When prompted for AD DS credentials: sign in with your on-prem Domain Admin account (lakeviewlogistics\Administrator or equivalent).
  Review the configuration summary — confirm it shows: Password Hash Synchronization, Hybrid Azure AD join enabled.
  Click Install. Wait for installation and initial sync to complete (~5 minutes).
  Do not close the installer until you see "Configuration complete".
• Phase 4 — Verify initial sync (8 min)
  On DC-01, open Synchronization Service Manager (Start → Azure AD Connect → Synchronization Service).
  Check the Operations tab — confirm recent Export operations to Azure Active Directory show Status = success. If any show errors, click the operation to see the error detail.
  Navigate to entra.microsoft.com → Users → All users. Filter by Source = Windows Server AD. Lakeview Logistics user accounts should now appear here as synced objects. Record how many user accounts are showing.
• Phase 5 — Verify Hybrid Azure AD join is configured (5 min)
  In Entra ID portal → Identity → Hybrid management → Entra Connect → Hybrid Azure AD join.
  Confirm it shows Enabled for your domain (lakeviewlogistics.local).
  This setting — enabled automatically by Express Settings — tells Entra ID to accept device registration from computers in this AD domain.
• Phase 6 — Configure the MDM auto-enrollment GPO (10 min)
  On DC-01, open Group Policy Management Console (GPMC).
  Right-click your domain → Create a GPO in this domain, and Link it here. Name it: Intune — MDM Auto-Enrollment.
  Right-click the GPO → Edit. Navigate to:
  Computer Configuration → Policies → Administrative Templates → Windows Components → MDM
  Double-click Enable automatic MDM enrollment using default Azure AD credentials. Set to Enabled. Under Options, set Select Credential Type to use to Device Credentials. Click OK.
  Close the GPO editor. The GPO is now linked at the domain level and will apply to all domain-joined computers.
• Phase 7 — Force a Delta sync (3 min)
  On DC-01, open Windows PowerShell as Administrator. Run:
  Import-Module ADSync
  Start-ADSyncSyncCycle -PolicyType Delta
  This pushes any pending computer object changes to Entra ID immediately rather than waiting for the 30-minute scheduled sync.
• Phase 8 — Trigger hybrid join on WIN-CLIENT-01 (12 min)
  Switch to WIN-CLIENT-01. Sign in as a domain user account.
  Open an elevated Command Prompt. Run:
  gpupdate /force
  This picks up the auto-enrollment GPO. The MDM enrollment process triggers in the background. Wait 2–3 minutes.
  Then run: dsregcmd /status
  Look at the Device State section. You need to see all three of these:
  AzureAdJoined : YES
  DomainJoined : YES
  WorkplaceJoined : NO
  If AzureAdJoined shows NO after 5 minutes: reboot WIN-CLIENT-01 and run dsregcmd /status again. Hybrid join sometimes requires a reboot to complete.
• Phase 9 — Verify in Intune portal (8 min)
  Navigate to intune.microsoft.com → Devices → All devices.
  WIN-CLIENT-01 should appear. If not visible yet, wait 5 minutes and refresh — it can take up to 15 minutes from the time the client joins to when it appears in the Intune portal.
  Click WIN-CLIENT-01 and explore the device record. Record:
  · Join type (should be: Hybrid Azure AD joined)
  · MDM (should be: Microsoft Intune)
  · Operating system and version
  · Compliance state (will show "Not evaluated" — no compliance policy assigned yet)
  · Last check-in time
  · Hardware inventory section — CPU, RAM, disk
• Phase 10 — Verify in Entra ID device list (5 min)
  Navigate to entra.microsoft.com → Devices → All devices.
  Find WIN-CLIENT-01. Confirm:
  · Join type: Hybrid Azure AD joined
  · Registered: today's date
  · Compliant: No (no compliance policy assigned yet — this changes on Day 2)
  · MDM: Microsoft Intune
  This is the device object that Conditional Access policies evaluate when checking device compliance.

⭐ Bonus: Hybrid join WIN-CLIENT-02 and force a manual sync

Quick debrief — three questions only

• Ask: "Your dsregcmd output shows AzureAdJoined = YES and DomainJoined = YES. What does WorkplaceJoined = NO confirm — why does that matter?" — surface that a full hybrid join is architecturally different from a simple personal device workplace registration
• Ask: "WIN-CLIENT-01 is now visible in Intune with Compliance state = Not evaluated. What needs to happen before the device shows Compliant or Non-compliant?" — prime Day 2's compliance policy assignment
• Preview Day 2: tomorrow the compliance policy gets assigned. WIN-CLIENT-02 will be intentionally broken to demonstrate what non-compliant looks like — and the CA001 policy will be updated to require a compliant device before granting M365 access