Microsoft Entra hybrid join network requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit af29d2d · +8 −7 lines · also on GitHub
⋯ 11 unchanged lines
1212
manager: amycolannino
1313
ms.reviewer: sandeo
1414
---
15
+
1516
# Configure Microsoft Entra hybrid join
1617
1718
Bringing your devices to Microsoft Entra ID maximizes user productivity through single sign-on (SSO) across your cloud and on-premises resources. You can secure access to your resources with [Conditional Access](~/identity/conditional-access/howto-conditional-access-policy-compliant-device.md) at the same time.
⋯ 12 unchanged lines
3031
3132
### Network connectivity requirements
3233
33
−Microsoft Entra hybrid join requires devices to have access to the following Microsoft resources from inside your organization's network:
34
+Microsoft Entra hybrid join requires devices to have access to the following Microsoft resources from inside your organization's network:
3435
3536
- `https://enterpriseregistration.windows.net`
3637
- `https://login.microsoftonline.com`
⋯ 2 unchanged lines
3940
- Your organization's Security Token Service (STS) (**For federated domains**)
4041
4142
> [!WARNING]
42
−> If your organization uses proxy servers that intercept SSL traffic for scenarios like data loss prevention or Microsoft Entra tenant restrictions, ensure that traffic to `https://device.login.microsoftonline.com` is excluded from TLS break-and-inspect. Failure to exclude this URL may cause interference with client certificate authentication, cause issues with device registration, and device-based Conditional Access.
43
+> If your organization uses proxy servers that intercept SSL traffic for scenarios like data loss prevention or Microsoft Entra tenant restrictions, ensure that traffic to `https://device.login.microsoftonline.com` is excluded from TLS break-and-inspect. Failure to exclude this URL might cause interference with client certificate authentication, cause issues with device registration, and device-based Conditional Access.
4344
4445
If your organization requires access to the internet via an outbound proxy, you can use [Web Proxy Auto-Discovery (WPAD)](/previous-versions/tn-archive/cc995261(v=technet.10)) to enable Windows 10 or newer computers for device registration with Microsoft Entra ID. To address issues configuring and managing WPAD, see [Troubleshooting Automatic Detection](/previous-versions/tn-archive/cc302643(v=technet.10)).
4546
⋯ 33 unchanged lines
7980
A federated environment should have an identity provider that supports the following requirements. If you have a federated environment using Active Directory Federation Services (AD FS), then the below requirements are already supported.
8081
8182
- **WIAORMULTIAUTHN claim:** This claim is required to do Microsoft Entra hybrid join for Windows down-level devices.
82
−- **WS-Trust protocol:** This protocol is required to authenticate Windows current Microsoft Entra hybrid joined devices with Microsoft Entra ID. When you're using AD FS, you need to enable the following WS-Trust endpoints:
83
+- **WS-Trust protocol:** This protocol is required to authenticate Windows current Microsoft Entra hybrid joined devices with Microsoft Entra ID. When you're using AD FS, you need to enable the following WS-Trust endpoints:
8384
- `/adfs/services/trust/2005/windowstransport`
8485
- `/adfs/services/trust/13/windowstransport`
8586
- `/adfs/services/trust/2005/usernamemixed`
8687
- `/adfs/services/trust/13/usernamemixed`
8788
- `/adfs/services/trust/2005/certificatemixed`
88
− - `/adfs/services/trust/13/certificatemixed`
89
+ - `/adfs/services/trust/13/certificatemixed`
8990
90
−> [!WARNING]
91
+> [!WARNING]
9192
> Both **adfs/services/trust/2005/windowstransport** and **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust Windows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**.
9293
9394
Configure Microsoft Entra hybrid join by using Microsoft Entra Connect for a federated environment:
⋯ 7 unchanged lines
101102
1. Select the forest.
102103
1. Select the authentication service. You must select **AD FS server** unless your organization has exclusively Windows 10 or newer clients and you configure computer/device sync, or your organization uses seamless SSO.
103104
1. Select **Add** to enter the enterprise administrator credentials.
104
−␣␣␣
105
+
105106
106107
107108
1. On the **Device operating systems** page, select the operating systems that the devices in your Active Directory environment use, and then select **Next**.
⋯ 13 unchanged lines
121122
122123
### US Government cloud (inclusive of GCCHigh and DoD)
123124
124
−For organizations in [Azure Government](https://azure.microsoft.com/global-infrastructure/government/), Microsoft Entra hybrid join requires devices to have access to the following Microsoft resources from inside your organization's network:
125
+For organizations in [Azure Government](https://azure.microsoft.com/global-infrastructure/government/), Microsoft Entra hybrid join requires devices to have access to the following Microsoft resources from inside your organization's network:
125126
126127
- `https://enterpriseregistration.windows.net` **and** `https://enterpriseregistration.microsoftonline.us`
127128
- `https://login.microsoftonline.us`
⋯ 19 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.