Windows Autopilot: Hybrid join pre-provisioning fails if policy conflict needs a domain controller

Summary

During Windows Autopilot pre-provisioning for Microsoft Entra hybrid join, the technician flow can fail when an assigned policy needs a domain controller to resolve a policy conflict. Microsoft describes this as a known limitation and expected behavior when the device has no line-of-sight to a domain controller. Microsoft documents ways to avoid it.

Symptoms

The technician flow fails. The event log contains an error similar to: MDM PolicyManager: Merge string, Area: (UserRights), Policy: (DenyLocalLogOn), Result:(0x800706FD) The trust relationship between this workstation and the primary domain failed. In off-premises scenarios with a bring-your-own (BYO) VPN, the VPN is not available during the technician flow, so the device cannot resolve the policy state.

Affected

• Windows Autopilot pre-provisioning (technician flow) with Microsoft Entra hybrid join
• Devices with assigned policies that require the client device management (DM) stack to contact an Active Directory domain controller to resolve a policy conflict
• Particularly off-premises provisioning with a BYO VPN

Workaround

1. Do not assign policies that require domain controller connectivity during the technician flow.
2. Alternatively, pre-provision the device on a network that has line-of-sight to a domain controller.

Fix

Not fixed yet. Microsoft describes this as a known limitation.

Recommendation

Review the policies assigned to hybrid join Autopilot profiles, in particular user rights settings such as DenyLocalLogOn, and avoid conflicts that need a domain controller. Run pre-provisioning on the company network or another network with a route to a domain controller, not over a BYO VPN.

Sources

• Windows Autopilot: known issues Vendor · learn.microsoft.com

Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 18:36.