Remote Location Device | Hybrid AD Join with Autopilot

Remote devices can complete Windows Autopilot Microsoft Entra hybrid join by using user-driven deployment with an Intune-delivered pre-logon VPN, with Skip AD connectivity check enabled in the Autopilot profile.

Required architecture

The remote device needs two connectivity paths during provisioning:

• Internet access for Windows Autopilot, Microsoft Entra ID, and Intune.
• VPN access to an on-premises domain controller before the first Windows sign-in. Skipping the AD check only postpones the connectivity test; it does not remove the requirement to contact Active Directory for domain join and credential validation.^1^

Use a VPN solution that either:

• Automatically connects when needed, or
• Can be started manually from the Windows sign-in screen.

VPN configurations that depend on a user certificate or a non-Microsoft UWP VPN plug-in are unsupported because they aren't available until after the user signs in.^2^

Configuration sequence

1. Configure hybrid identity and automatic enrollment
   • Configure Microsoft Entra hybrid join.
   • In Microsoft Entra ID, open Mobility (MDM and WIP) → Microsoft Intune.
   • Include the deploying users in MDM User scope.
   • If Microsoft Entra Connect uses domain or OU filtering, include the OU where Autopilot computer objects will be created.^3^
2. Install the Intune Connector for Active Directory
   • Install it on Windows Server 2016 or later with access to both the Internet and on-premises Active Directory.
   • Use connector version 6.2501.2000.5 or later; older versions cannot process enrollment requests.
   • Ensure its managed service account can create computer objects in the target OU.
   • For multiple domains, install a separate connector instance in each domain.^3^
3. Register and group the devices
   • Register each device with Windows Autopilot, normally through the OEM/partner or by importing its hardware hash.
   • Add the registered devices to the Microsoft Entra device group used for profile assignment.
4. Create and assign a Domain Join profile
   • In Intune, create a Domain Join configuration profile containing the AD domain and target OU.
   • Assign it to the same device group.
   • Confirm that the connector can create computer accounts in that OU.
5. Create the remote hybrid Autopilot profile
   • Go to Intune admin center → Devices → Windows → Enrollment → Deployment Profiles → Create Profile → Windows PC.
   • Set:
     • Deployment mode: User-driven
     • Join to Microsoft Entra ID as: Microsoft Entra hybrid joined
     • Skip AD connectivity check: Yes
   • Assign the profile to the Autopilot device group.^2^
6. Deploy the VPN before first sign-in
   • Package a non-Microsoft client as a Win32 app when required.
   • Include the gateway and machine-level connection configuration.
   • If certificate authentication is required, deploy a device certificate, not a user certificate.
   • Target the VPN app, configuration, and certificate to the device group so they install during Autopilot.
   • If using Enrollment Status Page, make the required VPN components blocking applications so provisioning cannot proceed without them.
   Tested clients include Windows in-box VPN, Cisco AnyConnect, GlobalProtect, FortiClient, Pulse Secure, Check Point, Citrix NetScaler, and SonicWall. DirectAccess, UWP VPN plug-ins, and VPNs requiring user certificates are unsupported for this scenario.^3^
7. Validate before remote rollout
   • First confirm that the hybrid Autopilot process succeeds on the internal network.
   • On an existing hybrid-joined test device, verify that Intune creates an all-user/per-machine VPN connection:

Get-VpnConnection -AllUserConnection

• Confirm the VPN can resolve the AD DNS namespace and reach a domain controller.
• Run a remote pilot through OOBE and establish the VPN at the sign-in screen when prompted. Hybrid join requires both Internet and domain-controller connectivity.^4^

Design recommendation

For new remote devices, Microsoft recommends cloud-native Microsoft Entra join, rather than hybrid join, including for Autopilot deployments. Choose hybrid join only where the device must join the on-premises AD domain—for example, because of dependencies that cannot yet be moved away from domain-based management or authentication.^1^

If pre-provisioning is required instead of user-driven deployment, remote hybrid pre-provisioning follows the same basic VPN requirement and also uses Skip AD connectivity check = Yes; however, bring-your-own VPN configurations aren't supported in pre-provisioning mode.^5^

References

1. Windows Autopilot user-driven mode
2. User-driven Microsoft Entra hybrid join: Create and assign user-driven Microsoft Entra hybrid join Windows Autopilot profile
3. Deploy Microsoft Entra hybrid joined devices by using Intune and Windows Autopilot
4. User-driven Microsoft Entra hybrid join: Deploy the device
5. Pre-provision Microsoft Entra hybrid join: Create and assign a pre-provisioned Microsoft Entra hybrid join Windows Autopilot profile