M365 Hybrid Azure AD Join allows organizations to leverage their existing on-premises Active Directory infrastructure while benefiting from cloud-based services and features offered by Azure AD. However, this integration can sometimes present complex challenges. This post delves into a specific hybrid Azure AD join issue encountered by a client and outlines the troubleshooting steps taken to resolve it.

The Issue:

Users were experiencing intermittent failures during M365 Hybrid Azure AD Join process. Devices would initially appear as Hybrid Azure AD Joined in the Azure AD portal, but subsequently disconnect, leading to issues with accessing corporate resources protected by Conditional Access policies. These policies required devices to be Hybrid Azure AD Joined for compliance. The failures were seemingly random, affecting different users and devices without a clear pattern.

Initial Investigation:

The initial troubleshooting steps focused on verifying the core components of the M365 Hybrid Azure AD Join setup:

 

• • Azure AD Connect Synchronization: Verified that the Azure AD Connect was synchronizing computer objects from the on-premises Active Directory to M365 Azure AD. The synchronization status showed no errors, and the relevant organizational units were included in the synchronization scope.

• • Service Connection Point (SCP) Configuration: Confirmed that the SCP was correctly configured in the on-premises Active Directory, pointing devices to the correct Azure AD tenant. This is crucial for devices to discover the Azure AD tenant for the join process.

• • Group Policy Settings: Reviewed the Group Policy settings responsible for triggering the Hybrid Azure AD Join. The “Register domain-joined computers as devices” setting was enabled and correctly configured.

• • Event Logs: Examined the event logs on the affected devices. The Device Registration event logs (under Applications and Services Logs\Microsoft\Windows\DeviceManagement-Enterprise-Diagnostics-Provider) provided valuable clues, indicating failures related to Conditional Access policies.

Identifying the Root Cause:

The event logs revealed a crucial piece of information: the failures were occurring specifically when the device was attempting to refresh its Primary Refresh Token (PRT). The PRT is a key component for single sign-on (SSO) and is essential for Conditional Access evaluation. Further investigation revealed a conflict between the Conditional Access policies and the device’s ability to obtain a new PRT after the initial join.

Specifically, a Conditional Access policy was configured to require multi-factor authentication (MFA) for all cloud apps when accessing them from outside the corporate network. While the initial device registration process typically handles MFA, the PRT renewal process was somehow failing to trigger MFA when required, leading to the device being flagged as non-compliant and subsequently disconnected from Azure AD.

Resolution:

The solution involved a multi-pronged approach:

 

1. 1. Conditional Access Policy Modification: We refined the Conditional Access policy to exclude the device registration service account from the MFA requirement. This service account is responsible for renewing the PRT in the background. By excluding it, we allowed the PRT renewal to proceed without triggering an unnecessary MFA prompt. Specifically, the built-in “Device Registration Service” cloud app was added to the exclusion list of the Conditional Access policy requiring MFA.

1. 1. GPO Refresh: Forced a Group Policy refresh on the affected devices using gpupdate /force to ensure the latest policy changes were applied.

1. 1. Device Re-registration: Re-registered the affected devices with M365 Azure AD to Join using the dsregcmd /leave command followed by a reboot and then allowing the automatic M365 Hybrid Azure AD Join process to complete.

Conclusion:

This case study highlights the complexity of troubleshooting M365 Hybrid Azure AD Join issues. While the initial symptoms pointed to a general join failure, the root cause was a nuanced interaction between Conditional Access policies and the PRT renewal process. By meticulously examining the event logs and understanding the underlying mechanisms, we were able to identify the conflict and implement a targeted solution. This experience underscores the importance of a deep understanding of Azure AD, Conditional Access, and the intricacies of Hybrid Azure AD Join when managing modern workplace environments. Careful policy design and continuous monitoring are crucial for preventing similar issues from recurring.