You’re designing session hosts for a line-of-business app that uses on-premises SMB shares and requires Group Policy enforcement. The Azure VMs will access a Windows Server file server on-premises over a site-to-site VPN. Which join type should you choose for the session hosts?

Hybrid Microsoft Entra joined is the correct choice because it allows the session hosts to be joined to your on-premises Active Directory (AD). This is essential for applying Group Policies and accessing on-premises SMB shares, as the session hosts will have a direct trust relationship with your on-premises domain. Microsoft Entra joined (cloud-only) would not allow Group Policy enforcement from on-premises AD or direct access to on-premises SMB shares. No domain membership (workgroup) would prevent Group Policy application and complicate access to network resources. Joining to an Azure AD DS managed domain without hybrid join would provide domain services in Azure but wouldn't directly integrate with your existing on-premises AD for Group Policy or SMB share access without additional configuration.