Share via

TPM and Entra Hybrid Join

Jon Kilner 86 Reputation points
2025-04-29T14:50:46.7633333+00:00

I'm in the process of reviewing the steps needed to migrate our ADFS federated domain to be 'managed' in Entra.

Once our Entra domain is managed, we intend to hybrid join our devices to take advantage of SSO.

I notice from https://learn.microsoft.com/en-us/entra/identity/devices/hybrid-join-plan#other-considerations that Hybrid join makes use of TPM2 chips to store the PRT's private key and does not support TPM1.2. The next bullet point states from 1903 and onwards, devices with TPM1.2 will be treated as not having a TPM chip.

Based on the information above, if I have a device running 1903+, can I hybrid join the device while the TPM 1.2 is enabled. Or, do I need to disable to TPM first?

Also, if the device doesn't have a TPM2 chip, where is the private key stored?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,382 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Akhilesh Vallamkonda 14,250 Reputation points Microsoft External Staff
    2025-04-30T16:56:54.8066667+00:00

    Hi @Jon Kilner

    To answer your question If you have a device with TPM 1.2, you must disable them before proceeding with Hybrid Azure AD join.
    Microsoft will not be disabling FIPS mode for TPMs as it is dependent on the TPM manufacturer.

    TPM 1.2 is not supported for storing the Primary Refresh Token (PRT) private key, this will be treated as the device has no TPM, even though TPM 1.2 is physically present.
    If a device does not have a TPM2 chip, the private key for the Primary Refresh Token (PRT) is not stored on a TPM. In such cases, the device uses as software-based encryption or other or security software.

    Hope this helps. Do let us know if you any further queries by responding in the comments section.

    If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.