This message was deleted.
# _generals
Slackbot
05/05/2023, 5:58 PMThis message was deleted.
r
Ryan Gallier
05/05/2023, 6:10 PMdefine "trusted"
💯 1
s
stormlight
05/05/2023, 6:12 PMpretty much a a fellow domain member. If on prem syncs with azure AD i would have assumed that Azure AD has some type of trust membership with on prem. However, that doesnt seem to be the case in my testing
r
Ryan Gallier
05/05/2023, 6:16 PMno, that's not the case at all. 🙂
k
Kasper Johansen
05/05/2023, 6:17 PMNo, for that trust to exist in both domains, it must be hybrid joined
s
stormlight
05/05/2023, 6:22 PMCan Microsoft cloud PCs or Microsoft VDI in Azure hybrid join? And what would they hybrid join to? Azure or on Prem?
k
Kasper Johansen
05/05/2023, 6:22 PMYes, they can 🙂
👍 1
Kasper Johansen
05/05/2023, 6:23 PMThe hybrid join means that the machine is joined to both the Active Directory domain and the Azure AD domain. And depending on your configuration, the authentication happens in either Azure AD or Active Directory or both
s
stormlight
05/05/2023, 6:25 PMI can look this up but is there downside to hybrid join over pure azure AD
k
Kasper Johansen
05/05/2023, 6:27 PMIt depends on how you look at it. In my opinion you shouldn't join a computer to the domain unless there is a specific reason. That reason might be an app dependency, legacy file server or print-solution, basically anything that relies on legacy Active Directory could be a reason to join your computer to the domain
Kasper Johansen
05/05/2023, 6:28 PMWhat is it you are trying to achieve?
s
stormlight
05/05/2023, 6:33 PMI have cloud PCs that i want to connect to our on prem domain to access resources. Print servers, files shares, apps ect. (it would go through our on prem to azure vpn)
k
Kasper Johansen
05/05/2023, 6:34 PMWell, you can create a provisioning policy to do the domain join during the W365 provisioning phase
s
stormlight
05/05/2023, 6:36 PMThe end goal is to decomission the on prem domain so im not sure i want to join the cloud pc to the on prem domain just to move it back to azure.
k
Kasper Johansen
05/05/2023, 6:36 PMYou will have to provide a network connection with line of sight to a domain controller
s
stormlight
05/05/2023, 6:39 PMOr is that my only choice. Join the Cloud PC to the on prem domain so that its hyrbid so it can get access to both on prem and azure servers and then when its time to decomission the on prem domain move the cloud pc back to azure asd
k
Kasper Johansen
05/05/2023, 6:40 PMYou don't have to join the machine to the domain to be able to access resources in that domain. As long as you provide a username and password that is valid in the domain, you should be able to access whatever that user has permissions to
Kasper Johansen
05/05/2023, 6:41 PMI have an Azure AD joined W365 machine with access to a network that can see my domain resources in my lab-setup. I can access domain resources from that W365 even though it's not joined to the domain
s
stormlight
05/05/2023, 6:44 PMYeah, i can do that to but some apps use domain credentials to work properly. So i guess for now in this inbetween life Hybrid join is the best bet
k
Kasper Johansen
05/05/2023, 6:44 PMYes, IMO hybrid is the "inbetween" until you can go pure cloud managed
💯 1
e
Eric
05/06/2023, 1:27 PMa
Aaron Parker
05/06/2023, 11:43 PMIf an Azure AD joined machine has line of sight to a domain controller, and you are using hybrid identities, the user will receive a Kerberos ticket and therefore have access to AD joined resources
👍 1
Aaron Parker
05/06/2023, 11:44 PMIf your use case is VDI that requires access to AD resources then it continues to make sense to joined those VMs to AD instead of Azure AD
💯 1
r
Ryan Gallier
05/08/2023, 5:47 PM@Webster Webster I think you accidently posted this in a thread when you wanted a separate post?
w
Webster Webster
05/08/2023, 5:48 PMSorry
r
Ryan Gallier
05/08/2023, 6:18 PMNo need to be sorry, I figured you would want more visibility with the message. 🙂
2 Views