Hybrid Domain Join via Workspace ONE UEM

June 23, 2021   |   by bgarmon

Last Updated 10/20/2021 with a few more details

Microsoft AutoPilot supports a Windows provisioning method called Hybrid Domain Join. With this method the computer starts the normal AutoPilot process and is then redirected by AutoPilot to perform an Active Directory Domain Join followed by a reboot then AutoPilot continues registering the device with Azure. The big caveat with this process is that it requires line-of-site to the domain controller. This means it works great if your computer is in the office but this is not a great method to use if your computers are being provisioned at home or off network.

I’ve blogged about Hybrid in the past, you can read this for more information: https://www.aftersixcomputers.com/hybrid-domain-join/

To set this up, here’s a 30-minute video, recorded by a co-worker, that shows you what you need to do:

Below are the steps illustrated in the video above:


  • Need access to AD Users and Computers, ADSI Edit,
  • Need admin access to Azure AD Connect,
  • Need admin access to Azure AD (portal.azure.com)
  • Need admin access to Microsoft Endpoint Manager Admin Console (endpoint.microsoft.com)
  • Need admin access to Airwatch Cloud Connector (ACC) server
  • Need admin access to VMware Workspace ONE UEM Console
  • Need 1 or more test Windows 10 devices, prefer VM’s

Special Notes:

As of UEM Console 2107 and below, there is no support for domain join activities that involve sub-OGs. For this process to work all of the Workspace ONE UEM configuration is expected to occur in the top-most (root) Customer OG. This includes the ACC/AD Integration, the UEM Console User accounts, the UEM Console Device Registration record, and all of the UEM Console domain configurations.

In Active Directory do this:

Note: If you don’t know how to complete the following items, the step-by-step instructions can be located on Step 6 of my previous blog about this topic found by clicking here: Part 1 of 2: Domain Join via Workspace ONE Tunnel.

  1. Define an OU in AD for devices to join.
  2. Create an AD service account that will be used to create computer objects in the OU. The account does not need admin roles in AD, standard user account is fine but Delegate control to create computer objects
  3. Launch ADSI Edit > msDS-MachineAccountQuota – set to 0
  4. Open Group Policy Management Console and enable the setting:
    Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration > Register domain joined computers as device”

On the Azure AD Connect server:

  1. Validate Azure AD Connect configuration:
  2. Configure device options must have Hybrid domain join enabled.
  3. SCP must be configured and enabled.

In the Azure Admin Portal (https://portal.azure.com):

  1. Under the Mobility (MDM and MAM) blade, make sure the two applications “Airwatch by VMware” and On-Premises MDM application” have been added and are properly configured.
  2. Under the Mobility (MDM and MAM) blade, validate the Microsoft Intune app is excluded from the scope used in the previous step
  3. Create a new Azure AD Group which will be used to assign computer objects an AutoPilot profile. Groups can be created directly in Azure Admin Portal, or they can be created in the Endpoint Manager Admin Console. Name the group something like HybridJoin_devices so that it is abundantly clear exactly what this group is for.

On the Windows 10 test device, register the device with AutoPilot:

The following steps walk through registering the Windows 10 device with AutoPilot which means the person running through this step must have permissions in the Azure tenant to register devices. If you are not an Azure Admin, have one available to be able to complete Step 4 below:

  1. Boot the computer into the Out-of-Box-Experience (OOBE).
  2. From the blue OOBE “Login to Microsoft screen”, bring up the Command Prompt by pressing
    Ctrl + F10 or Shift+F10 for HyperV
  3. From the Command Prompt type in powershell and press enter to launch Powershell
  4. From powershell run the following commands, pressing Enter after each line:
    Set-ExecutionPolicy Unrestricted
    Install-Script Get-WindowsAutoPilotInfo -Force
    Get-WindowsAutoPilotInfo.ps1 -online
  5. This will prompt for an admin login to Intune / MEM Admin Console
  6. When previous step finishes, copy the Serial Number for user later on
  7. Power Off the Windows 10 test device using the command shutdown /s
    Testing shows that if you try and continue OOBE without powering off the device it will not pick up the AutoPilot profile and fail miserably.

Microsoft Endpoint Manager Admin Console (https://endpoint.microsoft.com)

  1. Create AutoPilot Profile by navigating to:
    Devices > By Platform Windows > Windows Enrollment > Windows AutoPilot Deployment Program Deployment Profiles > Create Profile > Windows PC >
    Make sure Deployment Mode is User-Driven,
    Join to Azure AD as HYBRID Azure AD joined.
    This profile can’t be changed post Save, so make sure you choose your options wisely
  2. Assign AutoPilot Profile to Device by navigating to:
    Devices > By Platform Windows > Windows Enrollment > Windows AutoPilot Deployment Program Deployment DEVICES >
  3. Optional step instead of step 2: You could choose to add the Device Serial Number to the Azure Group then add the Azure Group to the AutoPilot preview

Note that Endpoint Manager may take a few minutes to assign the AutoPilot Profile to the device. In testing we’ve seen device assignment take 1 minute, we’ve seen it take 30 minutes. Be patient!!!! Do not proceed until this is completed, indicated by the “Profile Status” changing to Assigned. But if you just can’t bring yourself to be patient you can log into https://businessstore.microsoft.com and assign the AutoPilot profile there as well, it’s a bit of a hack but seems to work ok

Connect to Airwatch Cloud Connector (ACC):

  1. Confirm ACC is running version or higher.
  2. Add the AD Service Account created back in the beginning of this blog to the local Windows administrators group on the ACC
  3. Change ACC Service Logon As to the AD Service Account, restart the ACC Service

Launch Workspace ONE UEM Console:

  1. Settings > All Settings > Validate domain name show up properly in Enterprise Integration
  2. Create Devices & Users > Advanced > Tag > tag named ODJ
  3. Create Smart Group for Assignment based on Tags and assign ODJ tag
  4. Devices & Users > General > Enrollment > Optional Prompt > Windows > DISABLE EnrollmentStatus Page. Due to bug in UEM Console prior to 2105
  5. Domain Join Configuration – Pick a Machine name format
  6. For Assignment, Organization Units is the OU defined above. type in common name and UEM will search for full distinguished name.
  7. Pre-register the Device in UEM Console > Devices > Lifecycle > Enrollment Status > Add > register device
  8. Make sure user matches what you assigned in AutoPilot
  9. Make sure you add Serial number and Tag
  10. If users will not be on same network as Domain Controller, configure Prelogin VPN Client
    If you need help with this step see my previous blog:
    1. Configure UAG + Tunnel App + Device Traffic Rules for NETLOGON, Explorer, svhost, System and for Device Traffic Rule make sure you have *.domain.online and domain.online
    2. Configure Profile to apply Tunnel


Recent Comments

  1. Rahul Katneni

    September 15, 2021 @ 12:27 pm

    Does this require EMS E3 license?

    • bgarmon

      September 15, 2021 @ 1:36 pm

      This process requires a license for Azure AD Premium P1 or higher, and it requires Intune licenses. Both of these licenses are included in the EMS suites available.

Leave a Reply to bgarmon Cancel reply