Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into time-series-insights-how-to-add-an-event-source-eventhub

Author: atookey

articles/active-directory/devices/TOC.yml

@@ -37,7 +37,7 @@
     href: azureadjoin-plan.md
   - name: Plan your hybrid Azure AD join implementation
     href: hybrid-azuread-join-plan.md
-  - name: Control the hybrid Azure AD join of your devices
+  - name: Controlled validation of hybrid Azure AD join
     href: hybrid-azuread-join-control.md
   - name: Assign local admins to Azure AD joined devices
     href: assign-local-admin.md

articles/active-directory/devices/hybrid-azuread-join-control.md

@@ -1,132 +1,105 @@
 ---
-title: Control the hybrid Azure AD join of your devices | Microsoft Docs
-description: Learn how to control the hybrid Azure AD join of your devices in Azure Active Directory.
-services: active-directory
-documentationcenter: ''
-author: MicrosoftGuyJFlo
-manager: daveba
-editor: ''
+title: Controlled validation of hybrid Azure AD join - Azure AD
+description: Learn how to do a controlled validation of hybrid Azure AD join before enabling it across the entire organization all at once
 
-ms.assetid: 54e1b01b-03ee-4c46-bcf0-e01affc0419d
+services: active-directory
 ms.service: active-directory
 ms.subservice: devices
-ms.workload: identity
-ms.tgt_pltfrm: na
-ms.devlang: na
 ms.topic: article
-ms.date: 07/31/2018
+
+ms.date: 05/30/2019
 ms.author: joflore
+author: MicrosoftGuyJFlo
+manager: daveba
 ms.reviewer: sandeo
 
 ms.collection: M365-identity-device-management
 ---
-# Control the hybrid Azure AD join of your devices
-
-Hybrid Azure Active Directory (Azure AD) join is a process to automatically register your on-premises domain-joined devices with Azure AD. There are cases where you don't want all your devices to be registered automatically. This is true, for example, during the initial rollout to verify that everything works as expected.
-
-This article provides guidance on how you can control hybrid Azure AD join of your devices. 
+# Controlled validation of hybrid Azure AD join
 
+When all of the pre-requisites are in place, Windows devices will automatically register as devices in your Azure AD tenant. The state of these device identities in Azure AD is referred as hybrid Azure AD join. More information about the concepts covered in this article can be found in the articles [Introduction to device management in Azure Active Directory](overview.md) and [Plan your hybrid Azure Active Directory join implementation](hybrid-azuread-join-plan.md).
 
-## Prerequisites
+Organizations may want to do a controlled validation of hybrid Azure AD join before enabling it across their entire organization all at once. This article will explain how to accomplish a controlled validation of hybrid Azure AD join.
 
-This article assumes that you're familiar with:
-
--  [Introduction to device management in Azure Active Directory](../device-management-introduction.md)
- 
--  [Plan your hybrid Azure Active Directory join implementation](hybrid-azuread-join-plan.md)
-
--  [Configure hybrid Azure Active Directory join for managed domains](hybrid-azuread-join-managed-domains.md) or [Configure hybrid Azure Active Directory join for federated domains](hybrid-azuread-join-federated-domains.md)
-
-
-
-## Control Windows current devices
+## Controlled validation of hybrid Azure AD join on Windows current devices
 
 For devices running the Windows desktop operating system, the supported version is the Windows 10 Anniversary Update (version 1607) or later. As a best practice, upgrade to the latest version of Windows 10.
 
-All Windows current devices automatically register with Azure AD at device start or user sign-in. You can control this behavior by using either a Group Policy Object (GPO) or System Center Configuration Manager.
-
-To control Windows current devices, you need to: 
-
-
-1.	**To all devices**: Disable automatic device registration.
-2.	**To selected devices**: Enable automatic device registration.
-
-After you verify that everything works as expected, you're ready to enable automatic device registration for all devices again.
+To do a controlled validation of hybrid Azure AD join on Windows current devices, you need to:
 
+1. Clear the Service Connection Point (SCP) entry from Active Directory (AD) if it exists
+1. Configure client-side registry setting for SCP on your domain-joined computers using a Group Policy Object (GPO)
+1. If you are using AD FS, you must also:
+   1. Configure the client-side registry setting for SCP on you’re an AD FS server using a GPO  
+   1. Uncheck “Automatically remove unused devices” under Services > Device Registration > Properties  
 
+> [!NOTE]
+> Ensure default configuration remains unchanged for “Register domain-joined computers as devices” GPO set to “Not Configured” and “Automatically register new Windows 10 domain joined devices with Azure Active Directory” set to “Yes” when using Configuration Manager.
 
-### Group Policy Object 
+After you verify that everything works as expected, you can automatically register the rest of your Windows current devices with Azure AD by [configuring SCP using Azure AD Connect](hybrid-azuread-join-managed-domains.md#configure-hybrid-azure-ad-join).
 
-You can control the device registration behavior of your devices by deploying the following GPO: **Register domain-joined computers as devices**.
+### Clear the SCP from AD
 
-To set the GPO:
+Use the Active Directory Services Interfaces Editor (ADSI Edit) to modify the SCP objects in AD.
 
-1.	Open **Server Manager**, and then go to **Tools** > **Group Policy Management**.
+1. Launch the **ADSI Edit** desktop application from and administrative workstation or a domain controller as an Enterprise Administrator.
+1. Connect to the **Configuration Naming Context** of your domain.
+1. Browse to **CN=Configuration,DC=contoso,DC=com** > **CN=Services** > **CN=Device Registration Configuration**
+1. Right click on the leaf object under **CN=Device Registration Configuration** and select **Properties**
+   1. Select **keywords** from the **Attribute Editor** window and click **Edit**
+   1. Select the values of **azureADId** and **azureADName** (one at a time) and click **Remove**
+1. Close **ADSI Edit**
 
-2.	Go to the domain node that corresponds to the domain where you want to disable or enable the auto-registration.
+> [!NOTE]
+> If a SCP is not configured in AD, then you should follow the same approach as described to [Configure client-side registry setting for SCP](#configure-client-side-registry-setting-for-scp)) on your domain-joined computers using a Group Policy Object (GPO).
 
-3.	Right-click **Group Policy Objects**, and then select **New**.
+### Configure client-side registry setting for SCP
 
-4.	Enter a name (for example, **Hybrid Azure AD join**) for your Group Policy Object. 
+Use the following example to create a Group Policy Object (GPO) to deploy a registry setting configuring an SCP entry in the registry of your devices.
 
-5.	Select **OK**.
+1. Open a Group Policy Management console and create a new Group Policy Object in your domain.
+   1. Provide your newly created GPO a name (for example, ClientSideSCP).
+1. Edit the GPO and locate the following path: **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry**
+1. Right-click on the Registry and select **New** > **Registry Item**
+   1. On the **General** tab, configure the following
+      1. Action: **Update**
+      1. Hive: **HKEY_LOCAL_MACHINE**
+      1. Key Path: **SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD**
+      1. Value name: **TenantId**
+      1. Value type: **REG_SZ**
+      1. Value data: The GUID or **Directory ID** of your Azure AD instance (This value can be found in the **Azure portal** > **Azure Active Directory** > **Properties** > **Directory ID**)
+   1. Click **OK**
+1. Right-click on the Registry and select **New** > **Registry Item**
+   1. On the **General** tab, configure the following
+      1. Action: **Update**
+      1. Hive: **HKEY_LOCAL_MACHINE**
+      1. Key Path: **SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD**
+      1. Value name: **TenantName**
+      1. Value type: **REG_SZ**
+      1. Value data: Your verified **domain name** in Azure AD (for example, `contoso.onmicrosoft.com` or any other verified domain name in your directory)
+   1. Click **OK**
+1. Close the editor for the newly created GPO
+1. Link the newly created GPO to the desired OU containing domain-joined computers that belong to your controlled rollout population
 
-6.	Right-click your new GPO, and then select **Edit**.
+### Configure AD FS settings
 
-7.	Go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Device Registration**. 
+If you are using AD FS, you first need to configure client-side SCP using the instructions mentioned above but linking the GPO to your AD FS servers. This configuration is needed for AD FS to establish the source for device identities as Azure AD.
 
-8.	Right-click **Register domain-joined computers as devices**, and then select **Edit**.
+## Controlled validation of hybrid Azure AD join on Windows down-level devices
 
-    > [!NOTE] 
-    > This Group Policy template has been renamed from earlier versions of the Group Policy Management console. If you're using an earlier version of the console, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Device Registration** > **Register domain joined computer as device**. 
+To register Windows down-level devices, organizations must install [Microsoft Workplace Join for non-Windows 10 computers](https://www.microsoft.com/download/details.aspx?id=53554) available on the Microsoft Download Center.
 
-9.	Select one of the following settings, and then select **Apply**:
+You can deploy the package by using a software distribution system like [System Center Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager). The package supports the standard silent installation options with the quiet parameter. The current branch of Configuration Manager offers benefits over earlier versions, like the ability to track completed registrations.
 
-    - **Disabled**: To prevent automatic device registration.
-    - **Enabled**: To enable automatic device registration.
+The installer creates a scheduled task on the system that runs in the user context. The task is triggered when the user signs in to Windows. The task silently joins the device with Azure AD with the user credentials after authenticating with Azure AD.
 
-10.	Select **OK**.
+To control the device registration, you should deploy the Windows Installer package to your selected group of Windows down-level devices.
 
-You need to link the GPO to a location of your choice. For example, to set this policy for all domain-joined current devices in your organization, link the GPO to the domain. To do a controlled deployment, set this policy to domain-joined Windows current devices that belong to an organizational unit or a security group.
-
-### Configuration Manager controlled deployment 
-
-You can control the device registration behavior of your current devices by configuring the following client setting: **Automatically register new Windows 10 domain joined devices with Azure Active Directory**.
-
-To configure the client setting:
-
-1.	Open **Configuration Manager**, select **Administration**, and then go to **Client Settings**.
-
-2.	Open the properties for **Default Client Settings** and select **Cloud Services**.
-
-3.	Under **Device Settings**, select one of the following settings for **Automatically register new Windows 10 domain joined devices with Azure Active Directory**:
-
-    - **No**: To prevent automatic device registration.
-    - **Yes**: To enable automatic device registration.
-
-4.	Select **OK**.
-
-You need to link this client setting to a location of your choice. For example, to configure this client setting for all Windows current devices in your organization, link the client setting to the domain. To do a controlled deployment, you can configure the client setting to domain-joined Windows current devices that belong to an organizational unit or a security group.
-
-> [!Important]
-> Although the preceding configuration takes care of existing domain-joined Windows 10 devices, devices that are newly joining the domain might still try to complete the hybrid Azure AD join because of the potential delay in the application of Group Policy or Configuration Manager settings on the devices. 
->
-> To avoid this, we recommend that you create a new Sysprep image (used as an example for a provisioning method). Create it from a device that was never previously hybrid Azure AD joined and that already has the Group Policy setting or Configuration Manager client setting applied. You must also use the new image for provisioning new computers that join your organization's domain. 
-
-## Control Windows down-level devices
-
-To register Windows down-level devices, you need to download and install the Windows Installer package (.msi) from Download Center on the [Microsoft Workplace Join for non-Windows 10 computers](https://www.microsoft.com/download/details.aspx?id=53554) page.
-
-You can deploy the package by using a software distribution system like [System Center Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager). The package supports the standard silent installation options with the quiet parameter. The current branch of Configuration Manager offers benefits over earlier versions, like the ability to track completed registrations.
-
-The installer creates a scheduled task on the system that runs in the user’s context. The task is triggered when the user signs in to Windows. The task silently joins the device with Azure AD with the user credentials after authenticating with Azure AD.
-
-To control the device registration, you should deploy the Windows Installer package only to a selected group of Windows down-level devices. If you have verified that everything works as expected, you're ready to roll out the package to all down-level devices.
+> [!NOTE]
+> If SCP is not configured in AD, then you should follow the same approach as described above to configure the client-side registry setting for SCP on your domain-joined computers using a Group Policy Object (GPO).
 
+After you verify that everything works as expected, you can automatically register the rest of your Windows down-level devices with Azure AD by deploying the package to all down-level devices and [configuring SCP using Azure AD Connect](hybrid-azuread-join-managed-domains.md#configure-hybrid-azure-ad-join).
 
 ## Next steps
 
-* [Introduction to device management in Azure Active Directory](../device-management-introduction.md)
-
-
-
+[Plan your hybrid Azure Active Directory join implementation](hybrid-azuread-join-plan.md)