About Hybrid Azure AD joined devices
Hybrid Azure AD joined devices are devices that are joined to on-premises Active Directory and registered with Azure Active Directory (Azure AD). These devices allow you to take advantage of both on-premises Active Directory and Azure AD capabilities. With hybrid Azure AD join, you can centrally manage workplace devices that are joined to your on-premises Active Directory while your users can sign into their registered devices using Azure AD.
For organizations that have traditional on-premises AD environments but increasingly need to allow remote user access to cloud services, Azure AD joined and hybrid Azure AD joined devices balance these needs as shown in the in table:
|Self-service enrollment||Requires corporate network access||Support GPOs|
Azure AD Join
|Yes||No||Azure AD Domain Services|
Hybrid Azure AD Join
|Yes||Yes||AD Domain Services|
Once you implement Azure AD or hybrid Azure AD join, you can integrate it with Okta to provide federation and authentication services.
How to hybrid join devices
To join an AD-joined device to Azure AD, you need to set up Azure AD Connect for hybrid Azure AD join. Additionally, you also need to create a GPO that auto-enrolls AD-joined devices in Azure AD.
When an AD-joined device attempts to join Azure AD, it uses the Service Connection Point (SCP) you configured in Azure AD Connect to find out your Azure AD tenant federation information. It attempts to hybrid join but fails because the userCertificate attribute of the computer object is not yet synced with Azure AD. However, upon failure, the attribute is updated on the device with a certificate from Azure AD. Azure AD Connect syncs this attribute to Azure AD in its next sync interval. Next time when a scheduled task in the GPO retries to hybrid join the device, the task is successful and the device is joined in Azure AD.
This process may take several hours. If you encounter problems during the process, see Troubleshooting hybrid Azure Active Directory joined devices (Microsoft docs).
How Okta works with Hybrid Azure AD joined devices
Once your devices are hybrid Azure AD joined, you can use Okta as an Identity Provider (IdP) to secure enrollment and sign on processes on these devices. Okta verifies the user’s identity information, and then allows them to register their device in Azure AD or grants them access to their Office 365 resources. The user authenticates with Okta before they can sign into Microsoft Office 365 and other Azure AD resources.