\ Malcolm Soto – Article

Device Write Back

What Is Device Writeback?

The point of device writeback is to bridge the gap between cloud-registered devices and on-premises Active Directory, enabling legacy systems and hybrid identity features to recognize and interact with those devices.

Device writeback allows Azure AD-registered devices (like those joined via Autopilot or Intune) to be written back into your on-premises Active Directory. This is useful for:

Prerequisites

How to Enable Device Writeback

  1. Launch Azure AD Connect
    Image 1
  2. Select “Configure device options”
    Image 2 Image 3 Image 4
  3. Enable Device Writeback
    Image 5
  4. Configure Hybrid Microsoft Entra ID Join
    Image 6

    Configure Hybrid Microsoft Entra ID Join

    This option enables hybrid join, meaning:

    • Devices joined to on-prem AD are automatically registered in Microsoft Entra ID (Azure AD)
    • Enables SSO, Conditional Access, and Intune enrollment for domain-joined machines
    • Required for group policy-based Autopilot deployments or co-management scenarios

    Use this when:

    • You want on-prem AD devices to be visible in Entra ID
    • You’re managing devices with GPOs or SCCM
    • You’re enabling Intune auto-enrollment for domain-joined endpoints

    Configure Device Writeback

    This does the reverse:

    • Devices that are registered in Entra ID (like Autopilot or Intune-managed devices) get written back to on-prem AD
    • Creates a device object in AD under a specified OU

    Required for:

    • Windows Hello for Business (certificate trust)
    • ADFS Conditional Access
    • Legacy apps that need AD device objects

    Use this when:

    • You need cloud-joined devices to be recognized by on-prem AD
    • You’re deploying Windows Hello for Business hybrid cert trust
    • You’re using ADFS for Conditional Access
  5. Configure Device Writeback
    Image 7
    • Cloud-joined devices are written back to on-prem AD
    • Creates device object in AD under a specified OU
    • Required for WHfB (cert trust), ADFS, legacy apps
  6. Prepare Active Directory
    Image 8
    • Provide Enterprise Admin credentials to auto-configure
    • Or download PowerShell script to manually prep AD
  7. Complete the Wizard
    Image 9 Image 10 Image 11

    Reference:
    https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-device-writeback

    • Confirm the writeback forest and container
    • Finish configuration and verify sync status