CP Object Not Populating for Hybrid Azure AD Join

Hello Microsoft Support Team,

We are experiencing an issue with Hybrid Azure AD Join in our environment.

Environment Details:

• On-premises AD Domain: ad.pflegeplus.de

Azure Tenant: pflegeplus.onmicrosoft.com

AD Connect Version: [insert version]

Client OS: Windows 10/11, domain-joined

6 remote sites, site-to-site VPNs, firewall verified

Issue Description:

We ran Azure AD Connect multiple times to configure Hybrid Azure AD Join.

The Service Connection Point (SCP) object exists in AD, but its attributes are empty:

displayName → blank

  `keywords` → blank
  
     `serviceBindingInformation` → blank
     
     As a result, domain-joined clients cannot complete Hybrid Azure AD Join (`dsregcmd /status` shows `AzureAdJoined : NO`).
     
     PowerShell/manual attempts to create/update the SCP fail or do not populate the attributes.
     
     Firewall, network, and client GPO settings have been verified and are correct.
     

Suspected Cause:

SCP object may be write-protected, or Azure AD Connect may not have sufficient permissions (Schema/Enterprise Admin) to populate the object.

Request: Could you please provide guidance on:

How to ensure SCP attributes (displayName, keywords, serviceBindingInformation) are correctly populated.

Any manual steps or fixes to allow Hybrid Azure AD Join to work in this hosted AD environment.

Thank you for your assistance.

Best regards,Hello Microsoft Support Team,

We are experiencing an issue with Hybrid Azure AD Join in our environment.

Environment Details:

On-premises AD Domain: ad.pflegeplus.de

Azure Tenant: pflegeplus.onmicrosoft.com

AD Connect Version: [insert version]

Client OS: Windows 10/11, domain-joined

6 remote sites, site-to-site VPNs, firewall verified

Issue Description:

We ran Azure AD Connect multiple times to configure Hybrid Azure AD Join.

The Service Connection Point (SCP) object exists in AD, but its attributes are empty:

displayName → blank

  `keywords` → blank
  
     `serviceBindingInformation` → blank
     
     As a result, domain-joined clients cannot complete Hybrid Azure AD Join (`dsregcmd /status` shows `AzureAdJoined : NO`).
     
     PowerShell/manual attempts to create/update the SCP fail or do not populate the attributes.
     
     Firewall, network, and client GPO settings have been verified and are correct.
     

Suspected Cause:

SCP object may be write-protected, or Azure AD Connect may not have sufficient permissions (Schema/Enterprise Admin) to populate the object.

Request:
Could you please provide guidance on:

How to ensure SCP attributes (displayName, keywords, serviceBindingInformation) are correctly populated.

Any manual steps or fixes to allow Hybrid Azure AD Join to work in this hosted AD environment.

Thank you for your assistance.

Best regards,

Samet Topcu

PflegePlus GmbH