Troubleshooting: Entra ID Hybrid Join Is Slow When Federated with a Cloud-Only SecureAuth IdP Deployment

Version Affected: All
 
 

Overview

Microsoft Entra ID Hybrid Join takes a long time to complete when the Entra ID domain is federated with a cloud-only SecureAuth IdP deployment. The federated join attempt fails, and the client has to wait for it to time out before falling back to fallback_sync to complete the Hybrid Join.

Cause

Federated join isn't supported with cloud-only IdP deployments. During a federated join, the client makes a local logon attempt to the IdP server over the windowstransport endpoint. Since a cloud IdP is not a member of your Active Directory domain, it cannot validate those credentials to allow the local logon, and Windows logs event IDs 4776 and 4625 ("Unknown user name or bad password") as a result.

Resolution

Add a new custom domain to your Entra ID tenant and keep it as managed (or use an existing managed custom domain if your tenant already has one). You can also add a child domain, such as child.contoso.com, which is federated by default, then use the Microsoft Graph API to convert it to a managed domain.

Once you have a managed custom domain, set the Service Connection Point (SCP) to use that managed domain instead of your federated domain. If you don't want to configure SCP tenant-wide yet, you can use Group Policy or the registry to update it for specific client machines instead.

With this change in place, the client always performs a sync join, so it never has to wait for a federated join to fail before falling back to sync join — making the overall Hybrid Join process faster.

For more information, see Microsoft's Hybrid Join documentation.

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.