---
title: "Join Windows 10 machine to Azure AD using hybrid domain join method"
slug: "join-windows-10-machine-to-azure-ad-using-hybrid-domain-join-method"
updated: 2025-04-04T16:46:41Z
published: 2025-04-04T16:46:41Z
canonical: "help.rapididentity.com/join-windows-10-machine-to-azure-ad-using-hybrid-domain-join-method"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Join Windows 10 machine to Azure AD using hybrid domain join method

# Join Windows 10 machine to Azure AD using hybrid domain join method

- 

We're going to see the steps on how to join Windows 10 or later machines to Azure Active Directory using hybrid domain join method. If you have an on-premises Active Directory domain services environment and you want to join your domain joined computers to Azure Active Directory we can accomplish this task by doing hybrid Azure AD join. When we hybrid join a device it means that it is visible in both our on-premises Active Directory and in Azure Active Directory, and then we can manage them from both.

## **Prerequisites**

We have two VMs for this set up. The first is our domain controller (Windows Server 2016), this domain controller is synced with an Azure Active Directory using Azure AD connect tool, and the second VM is our Windows 10 client computer which is joined to our on-premises active directory.

**Microsoft Entra ID Free license** does not support **Intune MDM.** In order to Setup Intune MDM, Azure Global Admin user should have **Microsoft Entra ID P1 or P2**.

## **Steps for Hybrid join in Intune**

To perform below steps you must have access to both an on-premises (Windows Server) administrator and an Azure AD global administrator.

1. Open Azure AD Connect. To install follow [link](https://help.rapididentity.com/docs/install-and-configure-azure-ad-connect-to-sync-on-premises-ad-users).
2. Click on **Configure**
3. Click on Configure device options and click **Next**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image 1.png)

![](blob:https://idauto.atlassian.net/fd7eae8d-5ece-463b-a958-0bfc35ecf2f0#media-blob-url=true&id=3a27acd2-feea-44ff-be82-8ba90c798d5a&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=image%201.png&size=83539&width=809&height=364&alt=)
4. Click on **Next**
5. We will now be prompted to enter credentials from a Azure AD tenant’s Global Administrator’s credentials, so already the username is displaying here. So, just need to enter the password and hit **Next**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image 2.png)

![](blob:https://idauto.atlassian.net/b204a4ba-0eaa-42d4-99bb-da007a5be5c1#media-blob-url=true&id=42cc4361-ce15-4fac-a7d8-8b79c8a0e7bb&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=image%202.png&size=68231&width=938&height=394&alt=)
6. Configure hybrid Azure AD join option is pre-selected and click **Next**. ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image(621).png)
7. Select what types of devices we intend to join, choose Windows 10 or later domain join devices and click **Next.** ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image(622).png)
8. Select the check box in front of our forest, click on the drop down arrow, and choose Azure Active Directory for Authentication Service and then click on **Add.**

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image 3.png)

![](blob:https://idauto.atlassian.net/4b4daf41-2f53-4604-931e-b8db393ca2f8#media-blob-url=true&id=18024ab2-a1bf-4224-bd8f-affe661b645b&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=image%203.png&size=135195&width=954&height=399&alt=)
9. Next, provide credentials for admin account and click **Ok** and **Next**.
10. Click **Next** and then click **Configure** on next page to start the process.
11. Click **Exit** when configuration completes.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image 4.png)

![](blob:https://idauto.atlassian.net/6e43eb38-8c0e-4b1d-8837-892a81427a0d#media-blob-url=true&id=f958bcbd-d1f0-436c-a5b3-08f40b46d6b3&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=image%204.png&size=76596&width=956&height=398&alt=)
12. Now run ***Start-ADSyncSyncCycle -PolicyType delta*** command on Admin Power shell to manually sync Azure AD to our on-premises Active Directory. If you receive an error when running above comment then check troubleshooting tips. ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image(623).png)
13. To confirm Windows 10 device registration we need to **reboot** Windows 10 once.
14. After reboot, sign into Windows 10 computer.
15. Open Command Prompt and type **dsregcmd /status**
16. If you see **AzureAdJoined** as YES under device state that means the device is hybrid Azure AD joined, as well as joined to our Azure Active Directory, under DomainJoined we can also see YES .

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image 5.png)

![](blob:https://idauto.atlassian.net/cb0e6312-7e14-448c-b095-bd39048595bc#media-blob-url=true&id=a4b8f4fd-3174-49c0-832a-0f45cfdc798c&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=image%205.png&size=217200&width=697&height=362&alt=)
17. If you **do not see Azure AD joined: Yes** then follow the given documents and complete your AD Group policy and MDM Intune Configurations: [Document](https://help.rapididentity.com/docs/group-policy-enrolling-a-device-in-microsoft-intune)

After configure GPO policies make sure you have done with the given [Pre-requisites](https://help.rapididentity.com/docs/group-policy-enrolling-a-device-in-microsoft-intune)
18. Note: **Microsoft Entra ID Free license** does not support **Intune MDM.** In order to Setup Intune MDM Azure Global Admin user should have **Microsoft Entra ID P1 or P2**.
19. Alternatively one can check if device is enrolled in Intune by logging into [Azure](https://aad.portal.azure.com/) portal.
20. Now go to **Device>All Devices** and here we can see join type is hybrid Azure AD join.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image 6.png)

![](blob:https://idauto.atlassian.net/4a1dfa34-d406-4ab5-886c-cc3a732e9d4d#media-blob-url=true&id=b8f0ad14-cb05-438e-bd1f-2f2c1bcaf98a&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=image%206.png&size=127752&width=654&height=284&alt=)
21. Make sure **Owner** as well as **MDM** column is also present in all devices page, if not than follow below steps:
  1. For owner, [add UPN Suffixes and update users (2nd point in the document)](https://help.rapididentity.com/docs/group-policy-enrolling-a-device-in-microsoft-intune).
  2. For MDM column update do [linked steps (2nd point in the document)](https://help.rapididentity.com/v1/docs/deployment-of-msi-packages-through-microsoft-intune).

## **Troubleshooting tips**

1. If in case you see device state as **Pending** in Registered column under All devices in [Azure](https://aad.portal.azure.com/) portal then to fix the problem follow below steps.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/pending.png)

![](blob:https://idauto.atlassian.net/d8914a87-c291-4c46-a385-2638a82a7068#media-blob-url=true&id=c151edac-338e-4961-9aa0-46897903936b&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=pending.png&size=62667&width=1253&height=415&alt=)
  1. Go to machine which is showing as **Pending** state
  2. Open **Command Prompt** and type **dsregcmd /leave**
  3. The device will get unregister which can again verified by typing **dsregcmd /status** in Command Prompt
  4. **Restart** the machine
  5. Again open **Command Prompt** and type **dsregcmd /status** , you will see AzureAdJoined as yes
  6. Now again open [Azure](https://aad.portal.azure.com/) portal, Go to All Devices
  7. You will see timestamp under Registered column

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/timestamp.png)

![](blob:https://idauto.atlassian.net/3c092102-b076-44cd-80e0-82f5e748f3c3#media-blob-url=true&id=f4b7a9e1-180a-4099-9894-9e90fde894fb&collection=contentId-2039283727&contextId=2039283727&mimeType=image%2Fpng&name=timestamp.png&size=44733&width=1250&height=310&alt=)

1. Running ***Start-ADSyncSyncCycle -PolicyType delta*** command on Admin Power shell:
  1. Run command ***Get-ADSyncScheduler*** on powershell and check if the value of SchedulerSuspended is True or False, if the same is True than the scheduler is suspended.
  2. Run ***Set-ADSyncScheduler -SchedulerSuspended $false*** to change the value of suspended to False.
  3. Now again run ***Start-ADSyncSyncCycle -PolicyType delta*** command and the same should be successful.