Entra ID Hybrid Join Troubleshooting: How to Diagnose and Fix Hybrid Azure AD Join Failures Using dsregcmd and the Hybrid Join Event Logs

Run dsregcmd as the affected user (not as administrator, not as SYSTEM -- user context shows the user-specific Primary Refresh Token state):

dsregcmd /status

Key sections and what they mean:

Device State section:

• AzureAdJoined: YES -- The device has successfully registered with Entra ID
• AzureAdJoined: NO -- Device is NOT registered. This is the failure state.
• DomainJoined: YES -- Device is joined to on-premises AD (expected for hybrid join)
• EnterpriseJoined: NO -- Expected (this is for workplace join, not hybrid join)

User State section (run as user, not SYSTEM):

• NgcSet: YES -- Windows Hello for Business credential is configured
• WorkplaceJoined: NO -- Expected for hybrid joined devices (YES here would indicate an older workplace join registration conflict)
• PRT: YES -- Primary Refresh Token is present (required for SSO)
• PRT: NO -- PRT is absent. Sign-in to Azure resources will fail or require interactive MFA every time.

Tenant Details section:

• TenantName and TenantId -- Verify these match your expected Entra ID tenant
• AuthCodeUrl -- Should point to login.microsoftonline.com for public cloud

If AzureAdJoined: NO, the device has not completed registration. The cause is in one of five places: SCP, network, Azure AD Connect sync, duplicate device object, or the device certificate.

The Service Connection Point (SCP) is an AD object that tells domain-joined devices which Entra ID tenant to register with. If the SCP is missing or misconfigured, devices cannot discover the registration endpoint and hybrid join fails silently.

Verify the SCP from a domain-joined machine:

# Check SCP in AD
$scp = New-Object System.DirectoryServices.DirectoryEntry
$scp.Path = "LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services," + (Get-ADRootDSE).configurationNamingContext
$scp.Keywords

Expected output:

azureADName:yourcompany.onmicrosoft.com
azureADId:your-tenant-guid

If this returns empty or an error, the SCP does not exist. Create it via Azure AD Connect:

1. Open the Azure AD Connect configuration wizard
2. Go to Configure device options
3. Select Configure Hybrid Azure AD join
4. Run the SCP configuration step

Alternatively, use the AAD Connect SCP script directly:

Import-Module "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1"
Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount domain\aadconnect-account -AzureADCredentials (Get-Credential)

After SCP creation, devices need to complete the hybrid join process. This triggers during user logon (not on the machine logon event). Log the user off and back on, or wait for the next scheduled task to run.

Azure AD Connect must synchronize computer objects from AD to Entra ID for hybrid join to work. Verify sync is running correctly:

# Check Azure AD Connect sync status
Get-ADSyncConnectorRunStatus

# Check last successful sync time
Get-ADSyncScheduler | Select-Object CurrentlyRunning, LastSuccessfulSyncCycleStartTimestamp, NextSyncCyclePolicyType

# Check for sync errors on computer objects
Get-ADSyncAADComplianceReport

For a specific computer object that is not appearing in Entra ID:

# Verify the computer is in scope for Azure AD Connect
Get-ADComputer -Identity COMPUTERNAME -Properties ObjectGUID, DistinguishedName |
Select-Object Name, ObjectGUID, DistinguishedName

Cross-reference the ObjectGUID with the Entra ID device list:

Connect-MgGraph -Scopes "Device.Read.All"
Get-MgDevice | Where-Object { $_.OnPremisesSecurityIdentifier -eq (Get-ADComputer COMPUTERNAME).SID }

If the computer object is in the correct OU and not showing in Entra ID after 72 hours:

1. Check that the OU containing the computer is within the Azure AD Connect synchronization scope (not filtered out)
2. Check for sync errors in the Synchronization Service Manager
3. Force a delta sync: Start-ADSyncSyncCycle -PolicyType Delta

Device writeback must be enabled for hybrid join to work in environments using Conditional Access device requirements. Verify in Azure AD Connect: Optional features > Device writeback = Enabled.

Hybrid join requires the device to reach the Entra ID device registration endpoint during the registration process. If the device is behind a proxy or firewall that blocks the required endpoints, registration will fail.

Required endpoints for hybrid join:

• https://enterpriseregistration.windows.net -- Device registration service
• https://login.microsoftonline.com -- Authentication
• https://device.login.microsoftonline.com -- Device-specific login
• https://autologon.microsoftazuread-sso.com -- Seamless SSO

Test connectivity from the device:

# Test connectivity to device registration endpoint
Test-NetConnection -ComputerName "enterpriseregistration.windows.net" -Port 443

# Check if a proxy is required and configured
[System.Net.WebProxy]::GetSystemWebProxy().GetProxy("https://enterpriseregistration.windows.net")

If a proxy is required, configure it for the SYSTEM account (the device registration task runs as SYSTEM, not as the logged-on user):

netsh winhttp set proxy proxy-server="http://proxy.company.com:8080" bypass-list="*.company.com;localaddress"

The userproxy setting (configured via Internet Options) applies to user-context operations. Device registration runs in SYSTEM context and requires the SYSTEM-level proxy configuration via netsh.

For conditional access environments where devices register from managed corporate networks, verify that the corporate network's proxy or firewall does not perform SSL inspection on the device registration endpoints. SSL inspection breaks the certificate validation during device registration in some configurations.

Even when AzureAdJoined shows YES, users may experience SSO failures if the Primary Refresh Token (PRT) is absent or invalid. The PRT is issued to the user at logon time after hybrid join succeeds.

Diagnose PRT state:

dsregcmd /status

Look in the User State section for:

• PRT: YES -- PRT is present
• PrtUpdateTime -- When the PRT was last refreshed (should be recent)
• PrtExpiryTime -- When the PRT expires (typically 14 days from issue)

If PRT is NO:

1. Verify the user's on-premises AD account is synced to Entra ID: A user whose AD account is not synced cannot get a PRT even if the device is hybrid joined
2. Check for duplicate device objects: Multiple device objects in Entra ID for the same physical device can cause PRT issues. In Entra ID > Devices, search for the device name and check for duplicates
3. Verify the device certificate is valid: The hybrid join device certificate (issued during registration) must be valid. Check in certmgr.msc for a certificate in Personal > Certificates issued by MS-Organization-Access. If expired or missing, re-register the device
4. Re-trigger PRT acquisition: Log off and log back on with domain credentials while connected to the corporate network (or VPN). The PRT is acquired during logon against an in-scope DC

For devices that are hybrid joined but not getting PRT for specific users (other users on the same device get PRT): the issue is user-specific, not device-specific. Check the user's UPN matches their Entra ID UPN exactly (including domain suffix).