move devices from AD joined to azure

goody-83 · 2022-07-19T07:21:04.000Z

We have 100 staff all over the UK that are joined to an AD domain, but because of the way of working has changed we are moving to AZure ad instead. Those staff laptops cant see a DC for a very long time unless they come to the office, and thats not often for many.

My question is, Can we get existing users signed into azure ad and dis-join the AD server even if the laptop cant see the domain controller.

jitensh · 2022-07-19T07:49:18.000Z

Current Scenario?

→ Are they joined to Azure AD or Joined to Domain.

→ What would you like to achieve?

goody-83 · 2022-07-19T08:15:02.000Z

They are currently AD joined only. We need to do a remote session with staff to get them signed into azure ad. This will create them a new local profile.

We want the laptops on azure only as AD will be going at some point.

Do they need to be dropped back to a workgroup? If so can this be done without DC viability?

spiceuser-2x5mo · 2022-07-19T11:53:05.000Z

Step 1 Import devices into AzureAD
Step 2 Mark machines as corporate owned
Step 3 Remove all machines from Local AD, joining machines to WorkGroup in the process
Step 4 Sign in user under Accounts > Access work or school, with AzureAD Sign-in UPN
Step 5 Deploy policies using Intune

goody-83 · 2022-07-19T11:56:37.000Z

Hi, but under step 3 of your list if the laptop cant see a domain controller, will it allow me to demote it to a workgroup as i assume it will want to write back to ad the changes to domain membership.