SC-300: Configure Hybrid Join with Entra Connect and Intune MDM Scope

Implement and manage hybrid identity

Answer Select Microsoft Entra Connect for the Domain option and Modify the mobile device management (MDM) user scope for the Intune option.

HOTSPOT Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains computers that run Windows 11. You have a Microsoft 365 E5 subscription. You plan to enable hybrid join and enroll the computers in Microsoft Intune. You need to recommend the software that should be deployed to the domain, and the actions that should be performed in Intune. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. exhibit

Community Insight

The question tests the distinction between identity synchronization tools (Entra Connect) and device management enrollment scopes, avoiding the trap of selecting 'Intune Connector' which is only for Autopilot scenarios.

This SC-300 hotspot question tests the configuration of Microsoft Entra hybrid join for on-premises Windows 11 devices. The correct solution requires deploying Microsoft Entra Connect to the domain and modifying the MDM user scope in Intune.

Candidates often select 'Intune Connector' instead of 'Microsoft Entra Connect'. This mistake arises from confusing the requirements for Hybrid Azure AD Join (which uses Entra Connect) with Windows Autopilot Hybrid scenarios (which use the Intune Connector).

Community Discussion (12 comments)

SwamoSc300 👍 1

Entra Connect installed on DC and MDM for corporate devices. WIP for BYOD

Ume1051 👍 1

Explanation Domain: Microsoft Entra Connect To enable Hybrid Microsoft Entra Join (formerly Hybrid Azure AD Join) for Windows 11 devices in an on-premises AD DS environment, you use Microsoft Entra Connect to synchronize identities and configure hybrid join. Intune: Modify the mobile device management (MDM) user scope To automatically enroll hybrid-joined Windows devices into Intune, you must configure the MDM user scope in Microsoft Entra ID/Intune. This enables automatic MDM enrollment of the hybrid-joined devices. Why not the others? Intune Connector for Active Directory ❌ Used primarily with Windows Autopilot scenarios involving on-premises AD join, not for enabling Hybrid Entra Join. Microsoft Entra provisioning agent ❌ Used for HR-driven and application provisioning scenarios. Windows Autopilot device preparation policy ❌ Used for Autopilot deployments, not required for hybrid join enrollment. WIP user scope ❌ Windows Information Protection is unrelated to device enrollment. Final Answer Domain: ✅ Microsoft Entra Connect Intune: ✅ Modify the mobile device management (MDM) user scope

ctshepard 👍 1

https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid?tabs=general-requirements%2Cupdated-connector%2Cwindows-server-2025

jitla7 👍 1

Entra Connect Modify MDM Unless using AutoPilot, then you would use intune connector. BUt this scenario is for hybrid join than entra connect is needed

ckr8 👍 3

answers are correct Intune connector and modify MDM Scope https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid?tabs=general-requirements%2Cupdated-connector%2Cwindows-server-2025

krzkrzkra 👍 1

1: Domain= Entra Connect - Required for hybrid Azure AD join 1: Intune= Modify the mobile device management (MDM) user scope Enables automatic enrollment into Intune

noa808a 👍 1

Domain = Entra Connect, Intune = Modify MDM.

noa808a 👍 2

I should also note, Intune connector for AD is partially correct, but is not the best answer to what the question is asking (steps for hybrid joining devices). Modifying the WIP user scope is also partially correct, however this would come after modifying the MDM scope, and is therefore not the best answer.

Frank9020 👍 14

1: Domain= Entra Connect - Required for hybrid Azure AD join 1: Intune= Modify the mobile device management (MDM) user scope Enables automatic enrollment into Intune

Waiuku2123 👍 2

1. Entra Connect (provisioning agent does not support devices) 2. Modify MDM User Scope to allow all (or some) users to enrol devices Autopilot not mentioned in the question, it is simply configuring Entra ID hybrid join for on premises devices

northgaterebel 👍 1

Answer seems correct. 1. Intune Connector for AD. 2. Modify the MDM user scope. https://learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid

Phil_79 👍 1

Autopilot is a provisioning solution meant to provision new computer from the out-of-the-box exeprience. To hybrid join a client to Entra, you just work on the Connect and on Intune tenant-side

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

To enable Hybrid Azure AD Join for existing on-premises computers, you must deploy Microsoft Entra Connect to the Active Directory Domain Services environment. This tool synchronizes identities and configures the hybrid join attributes. In the Intune portal, you must then Modify the mobile device management (MDM) user scope. Setting this scope allows users to automatically enroll their devices into Intune upon sign-in or via the Company Portal.

Why Other Candidate Answers Are Wrong

Intune Connector is incorrect because it is specifically designed for Windows Autopilot Hybrid deployment, not general hybrid join for existing devices. Windows Information Protection (WIP) is a data protection feature, not an enrollment mechanism. Selecting options related to BYOD or WIP ignores the requirement for corporate device enrollment and hybrid identity synchronization.

Community Comment Notes

Community consensus strongly supports using Microsoft Entra Connect and MDM User Scope. As noted by user Frank9020, "Entra Connect - Required for hybrid Azure AD join" and "Modify the mobile device management (MDM) user scope Enables automatic enrollment." User ckr8 confirmed this aligns with official documentation for hybrid join requirements. Several users clarified that while Intune Connector exists, it is not the best answer for this specific scenario as highlighted by noa808a.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-azure-ad-hybrid-authentication

Exam Strategy

Always distinguish between 'Hybrid Join' and 'Autopilot Hybrid'. If the question mentions 'existing on-premises computers' without mentioning Autopilot profiles, choose Microsoft Entra Connect. If it mentions 'Autopilot', consider the Intune Connector. For enrollment, always look for MDM User Scope modifications.

Frequently Asked Questions

What is the difference between Entra Connect and Intune Connector?

Entra Connect syncs identities and enables Hybrid Azure AD Join for all devices. Intune Connector is specifically for enrolling Autopilot devices in hybrid environments.

Why do I need to modify the MDM User Scope?

Modifying the MDM User Scope determines which users can automatically enroll their devices into Intune. Without this setting, hybrid-joined devices may not be managed.

More SC-300 FAQ →

Related Analysis

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide