Join Windows 7 to Azure AD

Hello,

i was wondering is someone has any info if this is possible, without first joining Win 7 machine to local domain.
Workplace Join app requires that Win 7 is joined to local domain to be able to join that machine to Azure AD.

So, can Win 7, which is in Workgroup be joined to Azure AD?

PS> Just to be clear when i say Azure AD, I am not talking about VM in Azure running ADDS or something like that, but just simple Azure AD.

Regards,
Ivan.
LVL 19
IvanSystem EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MaheshArchitectCommented:
No, you can't

Windows 7 don,t have native interface to join machine to azure ad
u need machine to be domain joined and adfs must be there which can join machine to azure AD

https://docs.microsoft.com/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MaheshArchitectCommented:
windows 10 devices can join to azure ad with workgroup as well
0
Hello ThereSystem AdministratorCommented:
A few useful notes:
Azure AD is not a fully functional domain, in it's default form it is mainly just a user and group store, which you cannot join machines to. Windows 10 has some special features that allow you to join to an Azure AD domain, but Windows 7 does not.

If you have the site-to-site VPN created, and if your Windows 7 PC networking is able to ping the DC running in the cloud, then sure, you can join it to that Windows Server domain.
Don't confuse Windows Server AD with Azure AD.  You cannot join a Windows 7 machine to an Azure AD domain.
0
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

MaheshArchitectCommented:
The DC Can be on premise, no site to site vpn tunnel is required
definitely you can join Windows 7 device to azure ad, only prerequisite is machine must be part of domain
there is small software package developed by ms and made available for win 7 and 8 clients which need to be installed, once installed machine will get registered with azure ad, intact u can locate machine within azure ad as registered device

note that adfs and federation to azure domain is must, else setup won't work
0
IvanSystem EngineerAuthor Commented:
Hi,

thank you for reply.

I know of a difference in Azure AD and ADDS, and that is why is specifically said Azure AD :)
As Mahesh wrote, you can join Win 7 to Azure AD but only if machine is in Windows domain already, which doe not help me in this situation.

One thing I cannot find is where it says that Win 7 Workgroup is not supported. I cannot just say to a client that it cant be done, I kinda need a link to MS where it says that it cannot be done because of this or that..

This client done not have on site DC, so that is why they wanted to join these machines directly to Azure AD. At that time I did not know you need domain joined Win 7.
0
MaheshArchitectCommented:
The purpose of registered device is to get device with mutual authentication
when u get mutual authenticated device, when it is joined to your specific onprem domain and joined to your specific azure ad tenant
this is possible because of adfs federation

otherwise tomorrow anybody can register computer to your azure ad tenant as long as he have cloud id in your tenant and password from any network
then registered device concept is not stands correct

https://docs.microsoft.com/en-in/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup#prerequisites

check above link, it need SCP to be published in ad, only domain joined machines can look and understand SCP

within SCP, it contains info about your federated azure tenant
0
IvanSystem EngineerAuthor Commented:
0
MaheshArchitectCommented:
In addition to above, you must keep device with onprem ad network online so that adfs can register it with azure ad
if u joined machine to ad domain and take out of premise and tried to join azure ad, it's not possible
the rule applies to all windows platforns

in case of win 10 if u join workgroup win 10 device to azure ad, it is simply called as workplace join and not azure ad registered
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.