EIDFED-011: Hybrid Join Configuration
- Platform
- Entra ID / M365
- Category
- Entra ID Federation & Hybrid Identity
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Hybrid Azure AD join registers on-premises domain-joined devices with Entra ID, enabling Conditional Access policies that require device compliance or domain join status. Misconfigured hybrid join settings can result in devices failing to register, which prevents users from satisfying device-based Conditional Access requirements, or can allow unauthorized devices to register if the service connection point is not properly secured. The configuration should be validated end-to-end.
Recommended value
Hybrid Azure AD join configured and functional with service connection point properly secured and device registration verified for all target OUs
Remediation
Verify the service connection point (SCP) configuration in Active Directory and ensure it points to the correct Entra ID tenant. Check that the hybrid join configuration in Azure AD Connect includes the correct domains and that required enterprise registration endpoints are accessible from client devices. Validate that devices are successfully registering by reviewing the device list in Entra ID and troubleshooting any devices that show a pending state.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-3