SC-300: Configure Hybrid Join with Entra Connect and Intune MDM Scope

SC-300 By islever Editorial Last updated

Implement and manage hybrid identity

Short answer

Select Microsoft Entra Connect for the Domain option and Modify the mobile device management (MDM) user scope for the Intune option.

Question

HOTSPOT
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains computers that run Windows 11.
You have a Microsoft 365 E5 subscription.
You plan to enable hybrid join and enroll the computers in Microsoft Intune.
You need to recommend the software that should be deployed to the domain, and the actions that should be performed in Intune.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit: SC-300: Configure Hybrid Join with Entra Connect and Intune MDM Scope

Key Takeaways

The question tests the distinction between identity synchronization tools (Entra Connect) and device management enrollment scopes, avoiding the trap of selecting 'Intune Connector' which is only for Autopilot scenarios.

This SC-300 hotspot question tests the configuration of Microsoft Entra hybrid join for on-premises Windows 11 devices. The correct solution requires deploying Microsoft Entra Connect to the domain and modifying the MDM user scope in Intune.

Common mistake: Candidates often select 'Intune Connector' instead of 'Microsoft Entra Connect'. This mistake arises from confusing the requirements for Hybrid Azure AD Join (which uses Entra Connect) with Windows Autopilot Hybrid scenarios (which use the Intune Connector).

Expert Analysis

Why the Answer Is Correct

To enable Hybrid Azure AD Join for existing on-premises computers, you must deploy Microsoft Entra Connect to the Active Directory Domain Services environment. This tool synchronizes identities and configures the hybrid join attributes. In the Intune portal, you must then Modify the mobile device management (MDM) user scope. Setting this scope allows users to automatically enroll their devices into Intune upon sign-in or via the Company Portal.

Why Other Candidate Answers Are Wrong

Intune Connector is incorrect because it is specifically designed for Windows Autopilot Hybrid deployment, not general hybrid join for existing devices. Windows Information Protection (WIP) is a data protection feature, not an enrollment mechanism. Selecting options related to BYOD or WIP ignores the requirement for corporate device enrollment and hybrid identity synchronization.

Community Comment Notes

Community consensus strongly supports using Microsoft Entra Connect and MDM User Scope. As noted by user Frank9020, "Entra Connect - Required for hybrid Azure AD join" and "Modify the mobile device management (MDM) user scope Enables automatic enrollment." User ckr8 confirmed this aligns with official documentation for hybrid join requirements. Several users clarified that while Intune Connector exists, it is not the best answer for this specific scenario as highlighted by noa808a.

Exam Strategy

Always distinguish between 'Hybrid Join' and 'Autopilot Hybrid'. If the question mentions 'existing on-premises computers' without mentioning Autopilot profiles, choose Microsoft Entra Connect. If it mentions 'Autopilot', consider the Intune Connector. For enrollment, always look for MDM User Scope modifications.

Frequently Asked Questions

What is the difference between Entra Connect and Intune Connector?

Entra Connect syncs identities and enables Hybrid Azure AD Join for all devices. Intune Connector is specifically for enrolling Autopilot devices in hybrid environments.

Why do I need to modify the MDM User Scope?

Modifying the MDM User Scope determines which users can automatically enroll their devices into Intune. Without this setting, hybrid-joined devices may not be managed.

More SC-300 FAQ →

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. ckr8 👍 3
    answers are correct Intune connector and modify MDM Scope https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid?tabs=general-requirements%2Cupdated-connector%2Cwindows-server-2025
  2. noa808a 👍 2
    I should also note, Intune connector for AD is partially correct, but is not the best answer to what the question is asking (steps for hybrid joining devices). Modifying the WIP user scope is also partially correct, however this would come after modifying the MDM scope, and is therefore not the best answer.
  3. Waiuku2123 👍 2
    1. Entra Connect (provisioning agent does not support devices) 2. Modify MDM User Scope to allow all (or some) users to enrol devices Autopilot not mentioned in the question, it is simply configuring Entra ID hybrid join for on premises devices
  4. Ume1051 👍 1
    Explanation Domain: Microsoft Entra Connect To enable Hybrid Microsoft Entra Join (formerly Hybrid Azure AD Join) for Windows 11 devices in an on-premises AD DS environment, you use Microsoft Entra Connect to synchronize identities and configure hybrid join. Intune: Modify the mobile device management (MDM) user scope To automatically enroll hybrid-joined Windows devices into Intune, you must configure the MDM user scope in Microsoft Entra ID/Intune. This enables automatic MDM enrollment of the hybrid-joined devices. Why not the others? Intune Connector for Active Directory ❌ Used primarily with Windows Autopilot scenarios involving on-premises AD join, not for enabling Hybrid Entra Join. Microsoft Entra provisioning agent ❌ Used for HR-driven and application provisioning scenarios. Windows Autopilot device preparation policy ❌ Used for Autopilot deployments, not required for hybrid join enrollment. WIP user scope ❌ Windows Information Protection is unrelated to device enrollment. Final Answer Domain: ✅ Microsoft Entra Connect Intune: ✅ Modify the mobile device management (MDM) user scope
  5. Phil_79 👍 1
    Autopilot is a provisioning solution meant to provision new computer from the out-of-the-box exeprience. To hybrid join a client to Entra, you just work on the Connect and on Intune tenant-side
Show 6 more comments
  1. krzkrzkra 👍 1
    1: Domain= Entra Connect - Required for hybrid Azure AD join 1: Intune= Modify the mobile device management (MDM) user scope Enables automatic enrollment into Intune
  2. jitla7 👍 1
    Entra Connect Modify MDM Unless using AutoPilot, then you would use intune connector. BUt this scenario is for hybrid join than entra connect is needed
  3. northgaterebel 👍 1
    Answer seems correct. 1. Intune Connector for AD. 2. Modify the MDM user scope. https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid
  4. ctshepard 👍 1
    https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid?tabs=general-requirements%2Cupdated-connector%2Cwindows-server-2025
  5. SwamoSc300 👍 1
    Entra Connect installed on DC and MDM for corporate devices. WIP for BYOD
  6. noa808a 👍 1
    Domain = Entra Connect, Intune = Modify MDM.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide