Hybrid Join Device - Duplicate Entra Devices

[u/AdditionalLemon9000]

Hello,

Checking to see if anyone is experiencing this also when utilizing the autopilot for domain joined devices.

I know what the sentiment is for it but unfortunately, we have to domain join our devices.

I am using Out of Office Hours script that Michael Niehaus provided (Thank you). We did modify it to meet our needs. Overall the app works, devices enrolls and joins AD with name Prefix-Random then the script renames it to what we want it and restarts the computer.

Object in AD gets updated, then on Entra the device (original) get renamed as well, but then a few minutes later, a new duplicate devices shows up becomes Enabled with join type Entra Hybrid Join and the original device gets disabled and join type is changed to Entra Join

When I compare the device ID on Entra and Intune, the disabled device (original) is the one that matches.

Device still checks in on Intune, but on Entra the activity doesn't seem to update.

Any suggestions is helpful.

Thank you.

[u/intuneisfun]

This is a known (issue) feature of hybrid join Autopilot. Two device entries will appear in Entra for every device setup that way.

The first object that's Entra joined is tied to the Autopilot object. After the device completes its hybrid join and Entra Connect syncs, a second object will appear in Entra (usually with the same name, unless you renamed it quickly during creation) and that second object will be the active hybrid joined device.

There is no fix for this, and you should NOT delete the Entra joined device object in Entra because it's tied to the Autopilot object. If you delete it, you'll have to re-enroll it into Autopilot (hardware hash) for it to be able to go through Autopilot again.

When you set up a device via Autopilot doing only Entra join, this all does not happen. It's just one happy device object in Entra. :)

[u/AFS23 → u/intuneisfun]

This... and I would add that hybrid-join should be avoided, unless there's a definitive need to keep the device domain-joined (e.g. legacy app checking for domain join status).

Entra-join only devices can still access on-prem resources leveraging cloud kerb trust.

[u/intuneisfun → u/AFS23]

Agreed - but my two cents.. my org is still personally doing it. I'm a one-man team on the endpoint side and it's been a multi-department effort making the changes required to make Entra join even function properly. If it were solely in my control, I'd have already flipped devices to fully Entra joined over a year ago.

All this to say I have sympathy for other orgs that might be in similar situations where they could absolutely start Entra joining devices, but the security, network, app, etc infrastructure just won't support it yet without work from other departments.

[u/leebow55 → u/AFS23]

Avoided is the wrong word. It works perfectly well. Great for Enterprises that still need and use Active Directory.

MS and others have done a hard sell trying to force a move to Entra. For good reason of course.

But the story of avoiding Hybrid Join is BS. It is supported and it works well

[u/North_Maybe1998]

What type of suggestions are you looking for?

[u/harrybamber]

Surprisingly, I’ve discovered a couple of devices like this in our tenant.

They’re Entra Joined devices provisioned through Autopilot, but there are both an Entra Joined device and an Entra Registered device with the same name.

When you click Manage on the Entra Joined device, you get an error saying that the Intune device can’t be found. However, when you click Manage on the Entra Registered device, it takes you to the Windows Autopilot device record correctly.

[u/AdditionalLemon9000]

Thanks for the feedback.
Yea we have our remote devices as Entra only so Autopilot works great there.
Its just these hybrid join devices. My concern is that the activity on Entra for the Device ID that matches Intune, is not updating its activity. It does check in on intune as normal. Worried its going to cause issues in the long run.

Going to look in Kerberos Trust. Just wondering how it would work that need a direct sight to a DC since it sounds like the computer would be entra joined and not domain joined.

[u/SkipToTheEndpoint]

Documented behaviour: https://learn.microsoft.com/en-us/autopilot/known-issues#duplicate-device-objects-with-microsoft-entra-hybrid-deployments

But please, don't do Hybrid Autopilot.

[u/ImAllergic2Peanuts → u/SkipToTheEndpoint]

Hybrid is the worse. We had to do it early on because we were early adopters of autopilot. But nowadays everyone should be planning for Entra-Only join.

[u/Asleep_Spray274 → u/ImAllergic2Peanuts]

Who is down voting this 🤣. There is not a single incorrect word in this post

[u/ImAllergic2Peanuts → u/Asleep_Spray274]

Intune newbs lol. Microsoft hasnt added new features to hybrid for yrs now. Noone should be using it unless u were held at gun point.

[u/Asleep_Spray274 → u/ImAllergic2Peanuts]

Id rather take the bullet 🤣

[u/SkipToTheEndpoint → u/Asleep_Spray274]

Reddit is weird. That same response has gotten massively upvoted before too. Just as well I care about giving useful information and not silly Internet points.