Hybrid Autopilot Issues

For this scenario, focus on how hybrid Autopilot devices are represented and when Intune actually “locks onto” the correct device object, plus known hybrid-specific behaviors and Conditional Access/compliance timing.

Key points and checks:

1. Understand the dual device IDs in hybrid Autopilot

• Hybrid Autopilot creates two device identities initially:
  • A Microsoft Entra ID device
  • A hybrid-joined (on-prem AD + Entra) device
• Until a user signs in successfully, Intune syncs and evaluates compliance only against the Entra device ID, not the hybrid one. The hybrid device’s compliance state shows as N/A in the Azure portal until that first sign-in completes.
• This can cause:
  • Conditional Access issues
  • Apparent delays in app deployment and policy processing
  • Confusion about which object Intune is targeting

Action:

• After deployment, ensure a user signs in interactively on the hybrid device and allow time for Intune to resync. Then verify which device object shows as managed and compliant.

2. Conditional Access and enrollment app exclusions

• If there are restrictive Conditional Access policies (especially in security-focused environments like those using third-party monitoring such as Arctic Wolf), verify the following exceptions are in place:
  • Microsoft Intune Enrollment is excluded from any CA policy that requires Terms of Use or compliant device.
  • Microsoft Intune and Microsoft Intune Enrollment are on the exclusion list for any “block all apps except excluded” or “require compliant device” policies.
• Without these exclusions, Autopilot enrollment can partially succeed but leave the device in a bad state where:
  • Enrollment completes
  • But compliance evaluation and app/policy flow are blocked or delayed

Action:

• Review Conditional Access policies and explicitly exclude:
  • Microsoft Intune Enrollment
  • Microsoft Intune
• Ensure no Terms of Use requirement is applied to the Intune Enrollment app.

3. BitLocker and compliance timing on Autopilot

• For Autopilot devices, BitLocker and Secure Boot status are not captured until after a reboot.
• Compliance policies that require BitLocker or Secure Boot must include a grace period; otherwise, the device can appear noncompliant or incomplete for some time.

Action:

• Confirm compliance policies for BitLocker/Secure Boot have a grace period (as low as 0.25 days) for Autopilot devices.
• Ensure the device has rebooted after encryption before expecting BitLocker status and recovery keys to be fully reflected in Intune.

4. Known hybrid Autopilot issues

• Hybrid Autopilot is more fragile than pure Entra join and has several known issues:
  • Temporary N/A compliance state on hybrid device ID until user sign-in.
  • Potential timeouts or failures in hybrid join flows (depending on OS build and updates).

Action:

• Confirm devices are on OS builds that include fixes for hybrid Autopilot issues if applicable to the Windows version in use.
• Validate that the Intune Connector for Active Directory is correctly installed in the same domain where the Autopilot devices’ computer accounts are created.

5. General guidance for hybrid vs Entra join

• Microsoft recommends using cloud-native Microsoft Entra join for new devices rather than hybrid join, including with Autopilot.
• The behavior observed (Entra join working flawlessly, hybrid join being “yuck”) aligns with this guidance: hybrid adds complexity (on-prem AD, connector, dual IDs, CA interactions) that Entra join avoids.

Action:

• Where possible, prefer Entra join Autopilot for new deployments.
• If hybrid is required (e.g., legacy on-prem dependencies), ensure:
  • Intune Connector for AD is healthy and in the correct domain
  • OU scoping is correct
  • Conditional Access and compliance policies are tuned for hybrid Autopilot (grace periods, app exclusions, first sign-in requirement)

6. Arctic Wolf angle

• No specific documented interaction with Arctic Wolf is present in the referenced material.
• Focus troubleshooting on:
  • Network/proxy inspection that might affect ODJConnector or Autopilot traffic
  • Conditional Access and device compliance timing
  • Dual device ID behavior and first user sign-in

Summary of practical steps:

1. Confirm a user signs in to the hybrid Autopilot device and wait for Intune sync; then re-check device objects, compliance, BitLocker key, and LAPS status.
2. Review Conditional Access to ensure Microsoft Intune and Microsoft Intune Enrollment are excluded from restrictive policies and Terms of Use.
3. Ensure BitLocker/Secure Boot compliance policies have a grace period and that the device has rebooted post-encryption.
4. Validate Intune Connector for AD is in the correct domain/OU path used by Autopilot.
5. Prefer Entra join for new devices where possible, per Microsoft guidance.

References:

• Windows Autopilot - known issues
• Windows Autopilot troubleshooting FAQ
• Deploy Microsoft Entra hybrid joined devices by using Intune and Windows Autopilot
• Step by step tutorial for Windows Autopilot user-driven Microsoft Entra hybrid join in Intune