6.1.2 Setting Up Automatic Hybrid Azure AD Join for Windows Devices

Installing Azure AD Connect

Install and configure Azure AD Connect on the Windows Server that you want to make the sync server.

1. Download AzureADConnect.msi.

2. Launch AzureADConnect.msi.

3. Click Customize > Install.

4. After the required components are installed, the User sign-in page appears. Select Do not configure.

   NOTE:If Azure AD Connect is already installed, you can configure it in Azure AD Connect by clicking Change user sign-in > Next.

5. On the Connect to Azure AD page, specify your Azure AD global admin account and password.

6. On the Sync > Connect Directories > Connect to your Active Directory Domain Service page, perform the following actions:

   1. In DIRECTORY TYPE, select Active Directory.

   2. In FOREST, specify the name of the forest.

   3. Click Add Directory.

   4. Select Use existing account.

   5. Specify the Active Directory Domain Services (AD DS) enterprise administrator credentials.

   6. Click Next.

7. On the Sync > Azure AD sign-in > Azure AD sign-in configuration page, select Continue without matching all UPN suffixes to verified domains.

8. On the Configure > Ready to configure page, select Start the synchronization process as soon as the configuration completes.

9. Click Install.

Configuring Device Options

1. Run Azure AD Connect.

2. Under Tasks, select Configure device options.

3. Click Next.

4. Specify your Azure AD global administrator credentials.

5. Select Configure Hybrid Azure AD join.

6. Click Next.

7. On the Device operating systems page, select the following options:

   • Windows 10 or later domain-joined devices

   • Supported Windows downlevel domain joined devices

8. Click Next.

9. On the SCP page, perform the following steps to configure the service connection point for each forest:

   1. Select the forest.

   2. Select the authentication service.

   3. Click Add and specify the enterprise administrator credentials.

10. Click Next.

11. On the Ready to configure page, click Configure.

Enabling Devices to be Registered with Azure AD

1. Log in to the Azure portal as an administrator.

2. In the left pane, select Active Directory.

3. Under Manage, click Devices > Device Settings.

4. Select All for Users may register their devices with Azure AD policy.

   For more information, see How to manage devices using the Azure Portal.

1. Configure the Active Directory userstore if the existing Active Directory user store’s search context does not contain the computers DN.

   1. Click Devices > Identity Servers > Edit > Local > User Stores.

   2. Click New.

   3. Specify user store’s IP address and credentials, replica details, and add the search context where domain joined computers exists. For example, CN=computers, DC=cloudtest, DC=info.

      For more information configuring a user store, see Configuring Identity User Stores.

2. Create a Kerberos class. See Creating the Authentication Class, Method, and Contract.

3. Create a Kerberos method for the existing Kerberos class.

   1. Click Devices > Identity Servers > Edit > Local > Methods.

   2. Click New.

   3. Specify a name, select the Kerberos class, and then select the user store created in Step 1.

   4. Click OK.

4. Configure WS-Trust STS.

   1. Click Devices > Identity Servers > Edit > WS-Trust > STS Configuration.

   2. Under Authentication Methods, move the Kerberos method created in Step 3 from Available Authentication Methods to Selected Authentication Methods.

   3. Click OK.

5. Edit the following file:

   On Linux: /opt/novell/nam/idp/webapps/nidp/WEB-INF/web.xml

   On Windows: C:\Program Files\Novell\Tomcat\webapps\nidp\WEB-INF\web.xml

6. Add the NetIQSTS12MEX Servlet with the following details:

   <servlet>
     <servlet-name>NetIQSTS12MEX</servlet-name>
     <jsp-file>/jsp/mex.jsp</jsp-file>
     <load-on-startup>1</load-on-startup>
   </servlet>
   <servlet-mapping>
     <servlet-name>NetIQSTS12MEX</servlet-name>
     <url-pattern>/wstrust/sts/mex</url-pattern>
   </servlet-mapping>

   NOTE:Ensure to comment out the following Servlet mapping:

   <!--
   <servlet-mapping>
     <servlet-name>NetIQSTS</servlet-name>
     <url-pattern>/wstrust/sts/mex</url-pattern>
   </servlet-mapping>
   -->

7. Restart Identity Server.

1. Open a Windows PowerShell prompt.

2. Run the following command:

   dsregcmd.exe /status

3. Verify that the following parameters have the corresponding values:

   Parameters under Device State

   • Azure DA Joined: YES

   • Domain Joined: YES

   Parameters under User State

   • WorkplaceJoined: NO

   • WamDefaultSet: YES

   Parameter under SSO State

   • Azure AD PRT: YES

   The following is an example:

   

1. Open Microsoft Azure Active Directory Module for Windows PowerShell.

2. Run the following command to connect to your Azure Active Directory tenant:

   Connect-MsolService

3. Specify the Azure AD administrator’s credentials.

4. Run the following command:

   • To verify the status of all registered devices: Get-MsolDevice -All

   • To verify the status of a specific device using DeviceID: Get-MsolDevice -DeviceID "<device_id_value>"