Hybrid Azure AD Join Prerequisites: Microsoft Entra Hybrid Join Checklist

Hybrid Azure AD Join Prerequisites: Microsoft Entra Hybrid Join Checklist

Originally published 26 September 2020 · Reviewed 5 November 2026

Hybrid Azure AD join, now called Microsoft Entra hybrid join, registers a Windows device that is already joined to your on-premises Active Directory with Microsoft Entra ID as well. The user keeps domain sign-in and gets single sign-on to cloud resources, and you can use the device as a signal in Conditional Access. Most failed rollouts we see were missing a prerequisite, so this article is a planning checklist. It is not a step-by-step configuration guide, and it follows Microsoft's planning documentation, which you should check for current details before you change production.

What hybrid join is, and when to use it

Devices can be in Microsoft Entra ID in three ways: Microsoft Entra joined (cloud only), Microsoft Entra registered (typically personal devices), and Microsoft Entra hybrid joined (domain joined and registered). Choose hybrid join when devices must remain domain joined for Group Policy, file shares, on-premises applications or Kerberos, and you also want cloud single sign-on and device-based Conditional Access. If your devices no longer need the domain, Microsoft Entra join is simpler.

Identity prerequisites

• Active Directory in good health. Replication works, DNS resolves, and devices can reach a domain controller. Hybrid join registration begins on the device with a domain controller lookup.
• Microsoft Entra Connect with devices in scope. The organisational units that contain your computers must be in the sync scope, and Connect configures the service connection point (SCP) that tells devices which tenant to register with. In multi-forest designs, each forest needs a correct SCP.
• A suitable sign-in design. Hybrid join works with managed (password hash sync or pass-through authentication) and federated domains. Federated domains need working federation endpoints, and the authentication phase depends on them.
• UPN planning. Users sign in with a user principal name. Microsoft's planning guide distinguishes routable and non-routable on-premises UPN suffixes, and non-routable suffixes need extra care or an alternate login ID. Decide this before the pilot.
• Verified domains. The domain used by the SCP must be verified in the tenant.

Device prerequisites

• Supported Windows versions. Use current, supported Windows client and server releases. Microsoft's planning page lists exactly which, and older operating systems need extra steps or are no longer supported, so check the page for your fleet.
• Not on a domain controller. Microsoft states that hybrid join is not supported on a Windows Server running the domain controller role.
• Server Core. Microsoft states that Server Core does not support device registration.
• TPM. Hybrid join works with TPM 2.0. Microsoft documents that TPM 1.2 devices are treated as if they have no TPM from Windows 10 version 1903.
• Registered state. Devices that are also Microsoft Entra registered can end up in a dual state. Microsoft recommends current Windows builds, which clear the registered state after hybrid join, and documents a policy value that stops domain-joined devices registering as personal devices.

Network prerequisites

Registration happens in the SYSTEM context, which matters for proxies. The device needs outbound HTTPS access to the Microsoft device registration and sign-in endpoints that Microsoft lists on its planning pages (for example, the enterprise registration and device login services). If you use an authenticated proxy, test from the computer account, because a browser test in a signed-in user session does not prove that SYSTEM can pass. TLS inspection that breaks these connections will break registration.

Imaging and virtualisation

• If you use Sysprep with images, do not capture an image from a device that is already hybrid joined, unless Microsoft's guidance for your Windows version allows it.
• If you create virtual machines from snapshots, do not use a snapshot of a machine that is already registered.
• If you use write filters or technologies that discard disk changes at restart, apply them after the join completes, or the device will lose its registration every reboot.
• For virtual desktop infrastructure, follow Microsoft's separate guidance on device identity and desktop virtualisation.

Unsupported scenarios to rule out early

Microsoft documents that hybrid join is not supported when a single AD forest synchronises identities to more than one Microsoft Entra tenant, and that some profile roaming scenarios are restricted on down-level devices. Check the current planning page for the full list, because it changes with Windows releases.

Run a controlled pilot

Do not enable hybrid join for every device at once. Microsoft describes controlled validation: scope the SCP or the sync to a pilot group, confirm the join with dsregcmd /status (look for AzureAdJoined YES and DomainJoined YES), review the device list in the admin center, and test Conditional Access with a report-only policy before requiring a compliant or hybrid-joined device. If the join fails, our troubleshooting guide walks through the failure phases.

Before you start: a short sign-off list

Write down the answers to these questions and have the identity owner agree them. Which organisational units hold the computers to be joined? Which sign-in method does each domain use? Which UPN suffix do users sign in with, and is it verified in the tenant? Is there a proxy, and does the computer account authenticate to it? Which Windows versions are in the fleet, and are any servers in scope? Which images will be used to build new machines? Who will watch the first fifty devices register, and what will you do if they fail? A one-page record of these answers speeds up troubleshooting later and gives auditors a clear design decision to read.

Microsoft references

• Plan your Microsoft Entra hybrid join implementation, reviewed 5 November 2026.
• Troubleshoot devices by using the dsregcmd command, reviewed 5 November 2026.

This article was first published on 26 September 2020. It was rewritten on 5 November 2026 with current product names. It replaces the short post on hybrid Azure AD joined devices, which now redirects here. Microsoft's live documentation takes precedence if it has changed.