My newly created VM is not getting added to Azure Active directory. Ero has been attached in the detail, what can be cause for this?

Question

While adding 'AADLogin for windows' extension on newly created VM, it gives error that tenant id is not discoverable. The output of dsregcmd /status command is also attached

Error message -

2025-02-03T14:30:41.5877583Z [Information]: Discover tenant info with Tenant ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx. 2025-02-03T14:30:41.5877583Z [Information]: TenantInfo::Discover: DsrBeginDiscover failed. 0x80072ee7 2025-02-03T14:30:41.5877583Z [Information]: AzureSecureVMJoinOperation: DsrCmdAzureHelper::Discover with tenantId 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx' failed 0x801c0021. 2025-02-03T14:30:41.5877583Z [Error]: AAD Join failed with status code -2145648607. 2025-02-03T14:30:41.6034

Answer 1

Hello @Preeti Mishra,

Thank you for posting your query on Microsoft Q&A.

Based on your issue description, I understand that while you are adding 'AADLogin for windows' extension on your newly created VM, it gives error that tenant id is not discoverable.

When I reviewed the error message, I can see that the device is unable to get joined to Azure Active Directory(Microsoft Entra ID) and it is failing in the Discover phase.

Firstly, This error occurs when you have the MDM user scope (and/or the MAM user scope) set to Some or All. You need those scopes to be disabled for the VM to be able to be AAD joined.

To do this, navigate to the Microsoft Entra ID blade -> Mobility (MDM and MAM)

Select Microsoft Intune and set the MAM and MDM user scope to None.

If you have Microsoft Intune enrollment, do the same thing, that is set the MDM user scope to None.

Also, please check the below mentioned Possible causes of failures in the Discover phase.

Discover phase

Possible reasons for failure:

• The service connection point object is misconfigured or can't be read from the domain controller.
  • A valid service connection point object is required in the AD forest, to which the device belongs, that points to a verified domain name in Microsoft Entra ID.
  • For more information, see the "Configure a service connection point" section of Tutorial: Configure Microsoft Entra hybrid join for federated domains.
• Failure to connect to and fetch the discovery metadata from the discovery endpoint.
  • The device should be able to access https://enterpriseregistration.windows.net, in the system context, to discover the registration and authorization endpoints.
  • If the on-premises environment requires an outbound proxy, the IT admin must ensure that the computer account of the device can discover and silently authenticate to the outbound proxy.
• Failure to connect to the user realm endpoint and do realm discovery (Windows 10 version 1809 and later only).
  • The device should be able to access https://login.microsoftonline.com, in the system context, to do realm discovery for the verified domain and determine the domain type (managed or federated).
  • If the on-premises environment requires an outbound proxy, the IT admin must ensure that the system context on the device can discover and silently authenticate to the outbound proxy.

For additional details, please refer to the below document for your reference.

https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks and Regards,

Sanoop Mohan