This message was deleted.

Hrmm, conditional access policies should be helping here - azure ad hybrid join the vms and watch your CA policies….

vm's are onprem, i should have said that

Same same - are you using CA policies or hard stamped o365 mfa?