who are you and how can we know who you are when you log on to your device you have an identity
but did you know that your device has an identity as well
i'm Dean Cefola and this is the azure academy your devices can be in one of four states and
the reason for doing this video is to help you understand all of them so when things like windows
virtual desktop support all of these device states you'll be ready to make that transition
and the nice thing about that is you may not even need a domain controller anymore now the
big distinguishing factor between these four types really comes down to who owns the device and who
controls the device first one you're very familiar with this is active directory joined we've been
doing this for over 30 years everything is controlled through active directory we have
group policy management device management through things like configuration manager windows update
and plenty of other on-prem and traditional tools but now we can integrate things with azure active
directory and that starts with azure ad registered get it registered so azure ad registered is where
the machine is a bring your own device machine but we can have some level of corporate policies
applied through Azure AD as well as if you're using an mdm or mobile device management solution
like intune or microsoft endpoint manager we'll do a video on that pretty soon and those will give
you the ability to have more controls over that device even though the corporation doesn't own it
now the next scenario is azure ad hybrid joined this is where the machine is traditionally joined
to active directory but is registered in a more holistic kind of way to azure active directory
this is where you can still have all those group policy and traditional device management controls
combined with the power of the cloud and what we can push out from there and other mdm solutions
so real powerful choice but the one that i think is very future looking is azure ad
joined we no longer need that traditional domain controller see ya and now because we
don't need that domain controller anymore we're saving a bunch of money it's just azure active
directory and your device so let's take a quick minute and talk about some benefits that you're
missing out on for example did you know that 70 of you are watching the azure academy without
being subscribed that means you're not aware of when all the videos are coming out and you can't
really ask me any questions or contribute to any topics in the future so take the first step in
mastering azure today by clicking that subscribe button and the notification bell so what are the
benefits of each of these scenarios azure ad registered allows you to have single sign-on to
your cloud-based resources you can also have phone sign in through your microsoft authenticator app
you get conditional access through your enrolling those devices in your mdm solution that would be
intune and microsoft endpoint manager and remember this is a bring your own device kind of scenario
so they get on the computer with a local account and then sign in additionally in the settings menu
we'll show you that in a minute so that they can get access to those corporate resources
in the hybrid join scenario we get a bit more this is a corporate owned device scenario
and we're going to need our old friend azure ad connect in order to get this guy up and running
more about that in a minute remember you still have all of that on-prem traditional stuff but now
you can have single sign-on to those cloud-based or on-prem resources and self-service password
reset which we just did a video on so you can go check that out you also get access to the windows
hello features and you can also have enterprise state roaming across your different devices
finally the azure ad joined scenario where you get access to that seamless single sign-on for on-prem
and cloud resources as well as self-service password reset windows hello enterprise state
roaming and conditional access with your mdm compliance so let's get this all up and running if
you want to master the azure cloud you can start right now by clicking the subscribe button and
the notification bell so you don't miss anything all right let's get into this thing we're in azure
active directory and we're going to go on the left over to our devices and inside devices you can
see we don't have anything just yet but let's take a quick second and talk about our device
settings now this really has to do with who can enable a device to be joined to your azure ad
by default it's all people and then you can even limit the number of devices that everyone can have
20 is the recommended number but you can go up or down whatever suits your purpose so we've got
three scenarios so let's take the first one which is azure ad registered this is a basic windows 10
vm that is not currently joined to a domain at all just basically an out of the box system and here
is my command prompt where i'm going to run a ds reg command and in there you can see this is the
default state of windows 10. not joined anything and if we go over to our web browser and we try to
log into the azure portal it's going to prompt us for credentials because it doesn't have any
idea who we are so on the local system we'll open the settings panel go into accounts and then on
the left we want to go to access work or school then click connect we'll put in our credentials
and when you sign in if you have mfa enabled for your user account you'll be challenged for that as
i am and then your device will become registered which means the device is still yours but now you
are enabled to use workplace stuff so back in our command prompt you can see that we are workplace
joined that's registered and you can see we've got our tenant information so we'll do a little warp
speed back to the azure portal and go back to our devices and now we have an azure ad
registered system one down two to go this is our hybrid joined vm it is joined to our existing
active directory back in the ds reg command it only shows that it is joined to our domain nothing
related to azure ad yet our sso state is reporting as no and our diagnostic data tells us that we've
got a connectivity passed but everything else is failing because we need to do some things to set
this up back in our domain controller you can see my machine in the computer's container and that's
going to become important in a second because i'm not syncing that but let's take a quick look at
our group policy over here i've got an sso group policy in which i am enabling four different urls
that you have to add to your trusted sites in order for this whole process to work and then
back in azure ad connect we'll take a look at our synchronization options i'll add my credentials
and we'll skip past the first screen and here on the second screen for our domain and ou filtering
i am not syncing my entire domain structure you can see the computer's container is not
checked but the corp container is and everything under that is being synced into azure so let's go
back and now we'll change our device options click next and then you'll see that you can add hybrid
azure ad join which is exactly what we want let's hit next add your credentials and then the first
option that's selected already is to configure hybrid azure av join click next and now you have
the choice of device type windows 10 and newer would be the top one that's what i'll choose
if you have older devices you may want to select both although you should be using everything
windows 10 and newer to keep your security vulnerabilities low let's hit next now we need
to add a service connection point this is what's going to do the magic so i'll check my domain then
i'll hit the drop down for azure ad and then click add this is where you need enterprise
admin credentials which i'll put in there and then click next click configure and then hit
exit so that was easy let's open azure ads connect synchronization tool and at the top it should be
in operations by default but we want to go to the metaverse search i've got no clauses whatsoever
and i'll change my search type to device then over here i'll click search and you can see all
of the different devices that it is aware of back in active directory i'll take my computer object
from the computer's container and drag it into the azure computer's ou underneath corpse that way it
will be syncing and getting my policy then back in azure ad connect we'll go back to operations and
we want to right click and we want to do a delta import okay and that's going to find our object
and then do a delta synchronization in the same way that way we'll send that object off to azure
which we can find back in the metaverse search and there it is that device is now being written to
azure ad so when we go back to the machine and do our ds reg command we can see everything is now
passing so we're good to go this should be auto registered it just takes a reboot and now there's
all of our device details as well as our tenant information including our tenant name and id
so we're good to go we are not workplace joint so this is different than being registered however we
do get an sso state now so i can go back to the azure portal and i am sso'ed right into
azure ad we'll go back to devices and there you can see our hybrid join machine is now here
final one of the day is azure ad joined just as before with the registered we're starting off
with a vanilla machine not joined to a domain at all open the settings app go back to your account
click on access work or school click connect but this time at the bottom we're going to click on
join this device to azure active directory go through your sign in process mfa if you have to
and then it will ask you are you sure this is the organization you want to join if so click the join
button it'll go through the process and then you are all set and you can see the briefcase icon now
indicating that this is azure adjoined we're going to reboot and then log back in with the creds that
we just registered with go ahead and open your command prompt to dsreg and then you will see
that we are now azure ad joined and you can also see your device details as well as your tenant
information you'll have a user state because now you're actively logged in with a user on a
registered device and your sso is ready and we'll try to log on to the azure portal again sso works
back in azure ad go back to your devices and we've got our Azure AD joined device three different
device states that you can have as your device identity in azure very easy to set up no matter
which scenario you need and this is the gateway into those mdm solutions like intune microsoft
endpoint configuration manager which we'll have a video about real soon and now you're in a position
so that when windows virtual desktop and other features down the road support all these different
joined states then you'll be ready to implement them in your environment subscribe notification
bell comment click all the buttons and do all the things and if you want to learn more about azure
active directory over here on the bottom we've got our azure ad playlist there's our latest video
at the azure academy have a good week next week same bat time same bat channel happy learning