Azure AD joined devices // ADSystemInfo call cannot locate DC

Question

Hi,

We deploy our clients as Azure AD joined devices. Hybrid Azure AD joined devices would solve the problem I will describe below. However, this scenario would have downsides as I have been told. Does anyone have some more info on what one would loose when choosing the Hybrid scenario?

The problem is that we have a certain software which does a IADsADSystemInfo::get_UserName() call when starting the application. It would retrieve the username this way and compare it on the backend with active directory thus allowing or blocking access to the application.
Because it's a Azure AD joined device this call does not work because it cannot locate the domain controller and thus fails in making this ADSystemInfo call.
What would be the preferred way to work around this problem? Thanks

Answer 1

Hybrid joined devices are technically devices that are joined to Windows Server AD. So authentication of the device and the user will go to Windows Server AD.
Hybrid join is added on top, so that Azure AD “knows” something about the device.
On Azure AD joined devices, all interaction goes to Azure AD. Only if an application explicitely does Kerberos, a TGT is pulled.
I would say Hybrid join quite a big step backward.
Any chance to change that applications?

Greetings,
MrAzureAD

Answer 2

Unfortunately changing the application is not an option.

So, you confirm that Azure AD joined devices can (and should) not be able to locate a domain controller?

Answer 3

Azure AD isn't Active Directory Domain Services, therefor it does not contain information like DNs, site information, domain controllers, and so on.

These are your two options:

• Use Azure AD hybrid join where the client PC is both Active Directory and Azure AD joined.
• Change the application to support Azure AD-only joined devices.

Answer 4

When I don't have Azure AD hybrid join enabled -and- I join that client to the domain it works. Does anyone see a problem with such setup for the time being?

Answer 5

If you do Hybrid join, you are technically connected still to onprem AD, so everything should work the same way - your computer knows your onprem DCs. So if you go with hybrid join, your app should work as usual.