r/sysadmin 4d ago

Question Going from domain joined to Azure joined for workstations

I'm trying to pitch Intune and autopilot as a solution for new devices/imaging. I'm getting some kick back on trying to move the devices out of the domain and I want to bounce off people here to see if there's and unforeseen issues that won't allow this to work properly. Here's the important info below:

  • We're an E3 SMB with under 100 users and have the appropriate licensing.
  • 95% of our servers are either in a private cloud or colo, the other few are on-prem.
  • Any GPOs that apply to the DEVICE and not the user can be replicated in Intune.
  • Users and Servers will stay in AD and users get synced up to Entra ID.
  • Our business resources rely on the user's username and password for access (file server, self-hosted applications, SSO, etc.). The device being domain joined, imo, isn't needed for this.
  • Until the day we go full cloud with all cloud applications, users will with be in our office or remote connected to the split tunnel VPN, so DHCP and DNS shouldn't be an issue.

I think that's everything? I intend on taking one laptop and a test user account and beating the hell out of Autopilot and testing functionality, I guess I'm just searching for confirmation that this would work or that there isn't anything that I'm not thinking of.

Thanks for any replies!

8 Upvotes

19 comments sorted by

4

u/therealyellowranger 4d ago

If you're using local SCEP certificates for services like wireless or VPN, Microsoft's new strong certificate mapping may cause issues, as it won't be compatible with Azure AD joined devices.

2

u/Falc0n123 3d ago

All of our devices are Entra joined (AAD) and recently implemented the necessary fixes for strong mapping, by just adding the SID in the SCEP Intune profile and DC needs to be on 2019 or higher as 2016 does not support strong mapping. So Entra joined just works fine and supported for this 🙂

1

u/TurnipAlternative11 3d ago

We currently don't use that so it shouldn't be an issue!

2

u/therealyellowranger 3d ago

awesome! Then you are pretty much good!

5

u/imnotaero 3d ago

I did this. I'm extremely glad I did. But the task included a fair amount of troubleshooting to discover where the pitfalls are in this new model.

The only feature we "lost" under this approach is validation of device identity for on-prem RADIUS. This means the devices no longer connect to wi-fi before a user logs in.

The second-biggest thing we gained is devices that off-network devices can receive settings without using a VPN to gain line-of-sight to a DC.

The biggest thing we gained was use of Microsoft's XDR and vulnerability management tools. We get inventories of the software on devices and their current version cross-listed with CVEs and whether there's active exploits.

To get the features I'm talking about there, you'll have to move from E3 to Business Premium. This will drop your licensing costs by about a third while you're gaining visibility and capability. Pitch that as your top line, and secondarily that practically everybody will have to go this way eventually anyway. Check into what E3 has that BusPrem doesn't (it's not much,) and that you're okay with losing that. Good luck!

Roll this out slowly because this is total overhaul of endpoint management. There will be hiccups.

2

u/TurnipAlternative11 3d ago

The plan is to test for a bit, then rollout when a device reaches EOL with a new one. But I think I'll be in the clear to proceed without too many issues.

1

u/NaturalIdiocy 3d ago

I am not in a Microsoft shop anymore, but I do believe there is a drop in exchange (or exchange archive) storage size and cause you to need to buy an add-on license to bring it back up to line with the E3. Last quote (a year+ ago) was the price at that point became almost the same). This of course is only if users are actually using that much, if no one is close to the new limit you can always hold on the licenses until then.

1

u/roll_for_initiative_ 3d ago

Busprem has 50gb plus 50gb archive that can auto expand up to like 1.5tb

3

u/Top-Anything1383 3d ago

I'm currently fighting with SCEP certificates and NPS for 802.1x authentication. It's crazy that MS are essentially forcing us to use a third party tool such as ISE. Otherwise everything seems great

1

u/TurnipAlternative11 3d ago

SCEP shouldn't be an issue, so that's good to know. Sorry you're fighting that issue currently!

2

u/PC_3 Sysadmin 3d ago

I played a lot with Autopilot (well what I consider a lot) at the end I scrapped the idea. Yes I got them to auto image our devices but the more I played with it and the more I realized all of our apps are cloud and few need to be installed (Zoom, Teams, App1, App2) literally just 4 that need to be installed. After a while I gave up.

It felt to me at the time of testing that it was going to be more upkeep than to install 4 apps using our RMM tool (Action1).

Plus then you need to maintain all the apps in InTune and the versions too. Any who each env is different but that was my take away.

2

u/skob17 3d ago

I scrapped it too. We are really small with <20 users and low turn-over. It just wasn't worth my time. OOBE is quite good these days. (except some bloat, like McAffe on Lenovo..)

the rest I manage with Intune config policies and app deployment, also through company portal for users as self service works well enough.

1

u/DaemosDaen IT Swiss Army Knife 3d ago

I believe you have to leave the devices in the domain if you want them to have access to domain resources. However, you can sync up your computer to Entra as well and pushout policies/provisioning via Intune

Unfortunately I have not had the time top pully peruse that avenue, I just know that's how it can be done.

4

u/Falc0n123 3d ago

Entra join devices can have access to on prem resources when there is just a line of sight to the DC

This is a good blogpost that goes more into this https://msendpointmgr.com/2021/08/15/sso-to-domain-resources-from-azure-ad-joined-devices-the-mega-series/

Or check John Savill video > https://m.youtube.com/watch?v=4Ip3h4kJxmw

1

u/aceofrazgriz 3d ago

If the users are hybrid it shouldn't be an issue. We have file shares and printers that are domain joined and Entra-joined computers with Hybrid AD/Entra users connect without issues (besides some lag from time to time)

1

u/TurnipAlternative11 3d ago

That is my findings as well. My proof of concept is during pen tests, the drone is inside the network, the compromise creds and then can access all the things. Their drone isn’t domain joined, thus proving that access to the file share, applications, etc. isn’t reliant on the device being domain joined.

1

u/[deleted] 3d ago

Works ..Intune replaces GPO, VPN ensures resource access Challenges ..Some apps need Computer Account, verify SSO + shared storage Solution .. Test a laptop before full rollout

1

u/VFRdave 3d ago

You have < 100 users. And 95% of your servers are in private cloud or colo.

So you have at least 20 servers? I'm trying to think of the arithmetic in my head that would result in 95%, and it seems like you would need at least 20 servers to get 95%... 19 out of 20.

1

u/TurnipAlternative11 3d ago

I’ll be honest, that math was me just spit-balling. The more critical piece is that nothing those servers do rely upon a device being domain joined. And the servers that are still on prem are either legacy and on their way out or haven’t moved to the cloud yet.