Windows Autopilot is a cloud-based technology that administrators can use to configure new devices wherever they may be, whether on-premises or in the field. Devices provisioned with Autopilot are Entra ID joined by default and managed using Microsoft Intune. Optionally, an administrator can enable hybrid Entra ID join by also joining the device to an on-premises Active Directory domain using a domain join configuration profile in conjunction with the offline domain-join connector. Although enabling hybrid Entra ID join might sound appealing, there are specific deployment scenarios that present some rather unique and challenging problems when using this option.
Offline Hybrid Entra ID Join
For field-based devices, the device must have connectivity to a domain controller to support the initial login when the user has no local cached credentials. The Always On VPN device tunnel can be deployed in this scenario to provide connectivity and allow the user to log in to a new device the first time without being on-premises. The Always On VPN device tunnel is easily deployed using a Microsoft Intune device configuration policy. Certificates required to support the device tunnel can be deployed with Microsoft Intune and one of the certificate connectors for Intune.
Windows Professional
If a Windows 10 or 11 Professional device is configured using Autopilot, and hybrid Entra ID join is enabled, the Always On VPN device tunnel can still be provisioned, but it won’t start automatically because it requires Enterprise Edition to be fully functional. This prevents the user from being able to logon the first time. The device must be upgraded to Enterprise Edition before the first user logon. There are multiple ways to accomplish this depending on the deployment scenario and activation requirements.
Multiple Activation Key
The easiest way to upgrade Windows 10/11 Professional to Enterprise Edition is to obtain a Multiple Activation Key (MAK) and deploy that to clients using a Microsoft Endpoint Manager configuration profile. Follow the steps below to create a configuration profile to perform this upgrade.
- Open the Microsoft Endpoint Manager console and click on Devices > Configuration Profiles.
- Click Create profile.
- Select Windows 10 and later in the Platform drop-down list.
- Select Templates in the Profile type drop-down list.
- Select Edition upgrade and mode switch from the list of templates.
- Click Create.
Use the following steps to configure the settings for the configuration profile.
- Enter a descriptive name for the configuration profile in the Name field.
- Enter a description for the profile in the Description field (optional).
- Click Next.
- Expand the Edition Upgrade section and select Windows 10 Enterprise from the Edition to upgrade to drop-down list.
- Enter your multiple activation product key in the Product Key field.
Once complete, assign the configuration profile to the appropriate groups and click Create.
KMS Activation
If Key Management Service (KMS) activation is required, follow the steps listed previously for MAK. Enter the KMS client setup key for Windows 10/11 Enterprise which is NPPR9-FWDCX-D2C8J-H872K-2YT43. The device will complete KMS activation when it can connect to the on-premises KMS host.
Subscription Activation
Windows 10/11 Enterprise Edition licensing is included in some Microsoft 365 subscriptions. This poses a unique challenge for hybrid Azure AD join scenarios, however. Specifically, subscription activation is a “step-up” process that requires Windows 10 Professional to have been successfully activated previously. Also, this occurs after the user logs on, but the user cannot log on unless the device tunnel is active. Catch 22!
Workaround
A multi-step process is required to address the limitations imposed by subscription activation. To begin, the device must be upgraded to Enterprise Edition, so the device tunnel is available for the initial user logon. This is a temporary, one-time upgrade to Enterprise Edition solely for the purpose of getting the device tunnel to connect and allow the user to authenticate.
To begin, download this PowerShell script and follow the steps below to deploy it to Windows 10 devices using Microsoft Endpoint Manager.
- Open the Microsoft Endpoint Manager console and click on Devices > Scripts.
- Click Add and select Windows 10.
- Enter a descriptive name for the configuration profile in the Name field.
- Enter a description for the profile in the Description field (optional).
- Click Next.
- Enter the location of the PowerShell script in the Script location field.
- Click Next, then assign the script to the appropriate device group(s) and click Add.
The PowerShell script will automatically install the KMS client setup key for Windows 10 Enterprise Edition, then restart the network interfaces to ensure the device tunnel starts. This will immediately upgrade the client device to Windows Enterprise Edition and allow the user to authenticate.
Subscription activation with a step-up upgrade to Enterprise Edition still requires that Windows Professional be activated first. To accomplish this, the embedded Windows Professional key must be re-installed on the client. To do this, download this PowerShell script and follow the same steps listed previously to deploy a PowerShell script with Microsoft Endpoint Manager. However, this script should be assigned to users, not devices.
Once this script is run on the client it will be downgraded (temporarily) to Windows Professional edition. After activation is successful, subscription activation will once again upgrade the client to Windows Enterprise Edition.
Considerations
As you can see, the process of getting a Windows Professional edition client onboarded in a hybrid Entra ID joined scenario is somewhat complex. My advice is to avoid this scenario whenever possible. Access to on-premises resources with the Always On VPN user tunnel with full single sign-on support is still available for users on Windows 10/11 devices that are Entra ID joined only. Unless there is a specific requirement to manage client devices using on-premises Active Directory and group policy, consider choosing native Entra ID join with Autopilot and manage devices using Microsoft Intune exclusively.
Special Thanks
I would like to extend a special thank you to everyone in the Microsoft Intune community who provided valuable input and feedback for me on this topic, especially John Marcum, Michael Niehaus, and Sandy Zeng. Follow the #MsIntune hashtag on X to keep up on all things Microsoft Endpoint Manager.
Additional Information
Windows 10 Subscription Activation
Windows 10 Always On VPN Class-Based Default Route and Microsoft Endpoint Manager
Windows 10 Always On VPN Device Tunnel and Custom Cryptography in Microsoft Endpoint Manager
When configuring a Windows Routing and Remote Access Service (RRAS) server to support Internet Key Exchange version 2 (IKEv2) VPN connections, it is essential for the administrator to define the root certification authority for which to accept IPsec security associations (SAs). Without defining this setting, the VPN server will accept a device certificate issued by any root certification authority defined in the Trusted Root Certification Authorities store. Details about configuring IKEv2 security and defining the root certification authority can be found 
Unlike DirectAccess, Windows 10 Always On VPN settings are deployed to the individual user, not the device. As such, there is no support for logging on without cached credentials using the default configuration. To address this limitation, and to provide feature parity with DirectAccess, Microsoft later introduced the device tunnel option in Windows 10 1709.
