Project hybrid join to fully cloud

Hey Tsunami Tech, it sounds like you want to migrate from a hybrid (on-prem AD + Azure AD Connect) model to pure cloud (Azure AD joined + Intune enrolled) one user/device at a time—without losing mail or OneDrive data—so you can shut down your on-prem AD DCs and the AAD Connect VM. Here’s a high-level, step-by-step you can adapt, including sample Microsoft Graph PowerShell snippets.

Phase 1 – Convert your synced identities to cloud-only

1. Install the Graph modules and sign in. • Install-Module Microsoft.Graph.Users -Scope CurrentUser • Connect-MgGraph -Scopes User.ReadWrite.All, DeviceManagementManagedDevices.ReadWrite.All
2. Identify users still being synced from on-prem:

   
      $synced = Get-MgUser -Filter "onPremisesSyncEnabled eq true" -All
   
      $synced | Select-Object Id, UserPrincipalName
   
   

3. Break the sync link for each user so they become cloud-managed (ImmutableId cleared). This won’t affect mail or OneDrive data:

   
      foreach($u in $synced) {
   
        Set-MgUser -UserId $u.Id -OnPremisesImmutableId ""
   
      }
   
   

4. Verify they’re cloud-only:

   
      Get-MgUser -UserId ******@yourdomain.com | Select-Object UserPrincipalName, onPremisesSyncEnabled, onPremisesImmutableId
   
   

5. Make sure each user still has their O365 license(s) assigned so Exchange/OneDrive remain active:

   
      # Example: assign E3
   
      Set-MgUserLicense -UserId ******@yourdomain.com -AddLicenses @(@{SkuId="ENTERPRISEPACK"})
   
   

Phase 2 – Convert each device from hybrid-joined to Azure AD joined

On the Windows 10/11 device (user must be local admin):

1. Backup or note any local-only data just in case.
2. Leave the device’s hybrid state: • Open PowerShell as Admin → dsregcmd /leave • Settings → Accounts → Access work or school → select your domain connection → Disconnect
3. Join Azure AD: • Settings → Accounts → Access work or school → Connect → “Join this device to Azure Active Directory” • Have the user sign in with their Azure AD credentials
4. Confirm status:

   
      dsregcmd /status
   
      # Look for AzureAdJoined : YES  and DomainJoined : NO
   
   

5. Ensure automatic Intune MDM enrollment is still configured in the portal (Azure AD > Mobility (MDM & MAM) > Microsoft Intune > set scope = All). The device should show up in Microsoft Endpoint Manager as Azure AD joined + enrolled.

Phase 3 – Cleanup & decommission

1. After you’ve moved all users/devices, validate there are no more domain-joined machines or synced objects.
2. Uninstall/disable Azure AD Connect.
3. Shut down your on-prem AD DCs and the AAD Connect VM.

Reference docs you’ll find handy:

• Configure hybrid join & troubleshoot: https://learn.microsoft.com/entra/identity/devices/how-to-hybrid-join
• Hybrid vs. Azure AD joined devices: https://learn.microsoft.com/intune/solutions/cloud-native-endpoints/entra-join-types

Good luck with the migration—let me know if you hit any bumps!

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.