Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Tuesday, January 2, 2018 9:08 AM
We're using ADFS 3.0 on Server 2012R2, we've configured the AzureAD / Workplace Join. We've confirmed this is working well, however since some months some users having issues with our Conditional Access policies. The policy is that the Device needs to be registered to AzureAD when they want to access SharePoint Online. When the user goes to SharePoint Online they get a non compliant page, saying that device is not joined. When we run a dsregcmd /status the device says it's Azure Joined. But it seems the User State is not correct. We also deleted the device and re registered it, but the User State remains the same:
++
| User State |
++
NgcSet : NO
WorkplaceJoined : NO
WamDefaultSet : NO
AzureAdPrt : NO
++
| Ngc Prerequisite Check |
++
IsUserAzureAD : NO
PolicyEnabled : NO
DeviceEligible : YES
SessionIsNotRemote : YES
X509CertRequired : NO
PreReqResult : WillNotProvision
Looking in the event viewer we see Event 308: User Device Registration
This Device is joined to Azure AD, however, the user did not sign-in with an Azure AD account. Microsoft Passport provisioning will not be enabled. User: S-1-5-21-xxxxxxxxxxxxxx.
I've been working with Microsoft support on this, but i'm not really getting anywhere with them and this problem is getting bigger and bigger.
All replies (2)
Tuesday, January 2, 2018 9:16 AM
If user is connecting through Windows 10, then refer this page https://jairocadena.com/2016/01/18/how-domain-join-is-different-in-windows-10-with-azure-ad/ for Azure AD join
/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup
Tuesday, December 17, 2019 5:09 PM
Hello Jerx, did you find a resolution? I am now experiencing the same issue. Our environment is using PTA though, not ADFS. For most accounts, no issue, but there are a few who have the same error you mentioned.