Hybrid Join and Intune Enrollment for Conditional Access on Windows 11
Short answer
Microsoft Entra hybrid join the 500 Windows 11 devices so Policy1 can target them as Windows devices, and enroll the devices in Microsoft Intune so their compliance can be assessed.
Question
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices.
You have a Microsoft 365 subscription that syncs with the domain.
You create a Conditional Access policy named Policy1.
You need to meet the following requirements:
• Apply Policy1 to all the Windows devices.
• Assess the compliance of the Windows devices with Policy1.
What should you do for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
It tests the difference between giving an on-premises AD DS device an Entra identity for Conditional Access targeting and enrolling it in Intune for compliance state; the trap is choosing Entra registration or Intune alone.
This SC-300 scenario tests Conditional Access device targeting and compliance for on-premises Windows 11 devices. The required mapping is Microsoft Entra hybrid join to apply Policy1 and Microsoft Intune enrollment to assess compliance.
Common mistake: A common mistake is selecting Microsoft Entra registered or Microsoft Entra join, or expecting Intune enrollment by itself to make the existing AD DS devices targetable by Policy1; registration lacks the hybrid device trust and Entra join would replace the on-premises domain join.
Expert Analysis
The device must first exist in Entra
The 500 Windows 11 machines are joined only to on-premises AD DS. Microsoft 365 synchronization supplies user objects, but it does not automatically create usable device trust for Conditional Access. Policy1 evaluates a sign-in against device conditions such as platform and trust type, and an AD DS-only device has no matching Microsoft Entra device object. To apply Policy1 to all Windows devices, use Microsoft Entra hybrid join. Hybrid join registers each domain-joined device in the tenant and records a Hybrid Azure AD joined trust type while the device remains AD DS domain joined. A learner rationale captures the operational point: hybrid join preserves GPOs and on-premises authentication while adding the Entra device identity that Conditional Access needs. Entra registration is not the right choice for these existing domain-joined devices, and Entra join would change their join model.
Policy1 consumes an Entra device identity
After hybrid join, Conditional Access can target the devices by Windows platform and, if needed, by hybrid join state. Policy1 is applied to the device identity during token issuance. Without that identity, Policy1 cannot evaluate those 500 machines even though their users are synchronized.
Compliance needs Intune
Applying Policy1 and assessing compliance are separate tasks. Hybrid join creates the device in Entra, but compliance state comes from Microsoft Intune. Enroll the devices in Intune, assign a compliance policy, and then Conditional Access can use the requirement that the device be marked compliant. Intune evaluates the configured settings and reports each device as compliant or noncompliant. Enrollment without a compliance policy does not assess compliance, and a compliance policy without enrollment has no managed device to evaluate.
Required mapping
- Apply Policy1 to all Windows devices: Microsoft Entra hybrid join the devices to the tenant.
- Assess device compliance: Enroll the devices in Microsoft Intune.
If more configuration were required, you would also create an Intune compliance policy and select the compliant-device grant control, but the hotspot selections are hybrid join and Intune enrollment.
Official Reference
- https://learn.microsoft.com/en-us/entra/identity/devices/hybrid-join-plan
- https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions
- https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started
These links open the official vendor documentation in a new tab.
Exam Strategy
In device-related Conditional Access hotspots, separate three states: identity and trust in Entra (hybrid join, Entra join, or registration), management and compliance in Intune (enrollment plus compliance policy), and the Conditional Access grant control that consumes compliance. Ask which state the requirement names. For on-premises AD DS Windows devices, the option that preserves domain join and creates an Entra device identity is Microsoft Entra hybrid join; compliance assessment points to Intune enrollment and evaluation.
Frequently Asked Questions
Does Microsoft Entra hybrid join alone assess device compliance?
Can I use Microsoft Entra registered devices instead of hybrid join for these AD DS Windows 11 devices?
Why not Microsoft Entra join the devices?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
FS202 👍 3Microsoft Entra hybrid join the devices to the subscription Enroll the devices in Microsoft Intune
-
Tuyi 👍 1Apply Policy1 to all the Windows devices: Microsoft Entra hybrid join the devices to the subscription. Assess the compliance of the Windows devices: Enroll the devices in Microsoft Intune. Why hybrid join: The 500 devices are already joined to on-prem AD DS, and the tenant is synced. Hybrid join keeps them domain-joined (GPOs, on-prem auth still work) while giving each one a device identity in Entra, which Conditional Access needs before it can evaluate the device. Entra join would mean leaving the domain and rebuilding or re-joining 500 machines. That’s possible, but it’s not what the scenario points to. Entra register is for personal/BYOD devices. It’s the wrong trust type for corporate domain-joined machines. Why Intune: The CA grant control “Require device to be marked as compliant” reads a compliance flag, and Intune is what evaluates devices against compliance policies and writes that flag to Entra.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →