Microsoft Autopilot is a cloud-based solution that is used to provision new Windows devices and provides an alternative to the older imaging technology. When coupled with Intune, Autopilot enables vendors to drop-ship new machines directly to end users. The user then initiates an out-of-box provisioning experience by powering on the device, connecting it to the network, and signing in with their Entra ID credentials. Autopilot facilitates the build and performs an Entra join, or hybrid join, and enables an Intune enrollment. Intune then completes the build by installing apps, setting up BitLocker, and applying policies. This results in a fully configured Windows machine.
This process works particularly well if the Windows device is Entra joined and fully cloud managed. For those who still require Windows machines to be domain joined to an Active Directory (AD) infrastructure, the Intune Connector must be deployed to facilitate this process. Devices use the Intune Connector, also known as Offline Domain Join (ODJ), to join an AD forest, which facilitates an Entra hybrid join during the Autopilot build process. This article focuses on considerations for deploying Autopilot and the Intune Connector to perform an Entra Hybrid join.
The sole purpose of the Intune Connectors is to facilitate the offline domain join; however, it doesn’t provide line of sight to domain controllers if the Windows device is not on the network. If the objective is to implement a scenario where Windows devices can be drop-shipped to users — and those devices need to be hybrid joined—beware that Autopilot, the Intune Connector, and Intune will not achieve this goal. Without line of sight to the domain controllers, several required actions will fail:
- Completion of the domain join
- The completion of the hybrid join
- Group policies will not be applied
- Authentication will fail when a user attempts to log in
To perform a complete Windows build where the device is off network and an Active Directory or hybrid join is required, the device must use a VPN to provide line of sight to the domain controllers.
Though Windows 11 does have a native VPN client, it does not support the required components necessary to complete an off-network Autopilot build. Microsoft no longer offers a backend solution that provides a VPN service that accepts VPN connections. As such, a supported third-party VPN solution is required. This, of course, adds complexity and cost that organizations likely want to avoid. If this is the case, there are two options:
- Perform the build with the device on network, where the machine has direct line of sight to the domain controllers.
- Do an Entra join instead of a hybrid join. Microsoft has stated that Entra hybrid join is meant to be an interim solution until organizations can transition to the cloud-native Entra join. This requires significant planning and testing, and most organizations are not ready to fully embrace cloud native management of Windows devices.
In my work as a consultant who helps organizations implement Microsoft 365 and Intune, I have seen very few organizations successfully migrate their Windows machines from domain join to Entra join. On the other hand, many have successfully deployed cloud-native management for a subset of workers, such as a remote sales force. For many who still require hybrid join and want to rollout Autopilot, but don’t have or want to implement a VPN solution requiring the machine to be on network during the build works well.
If you are ready to proceed with this solution, here are a few pointers. For starters, this knowledge base article provides details on deploying Autopilot for Entra hybrid joined machines. It also includes a list of supported third-party VPN solutions.
The Intune Connector is installed on a domain joined machine. Multiple connectors can be installed to provide for high availability. It uses a group managed service account created by the installation program – named msaODJ <unique 5 digit number>.If the account used to install the connector has domain admin permissions, the installation routine will assign permissions for the account to create machine objects in the Computers container. I recommend creating a staging organization unit (OU) and updating the connector to put the machines objects in that OU (The link above provides instruction for this).
If your organization leverages Conditional Access policies requiring Windows devices to be hybrid joined in order to access Microsoft 365 / Azure resources, the Microsoft Device Registration Service app must be excluded from this policy. Failure to do so will prevent the machine from completing the Autopilot build.