Your environment has an Active Directory domain contoso.com with 25 Windows 11 PCs. An Azure AD tenant is synchronized with contoso.com and hybrid Azure AD join is enabled, but some machines show a registration state of Pending. What must you confirm to allow the devices to finish joining?

For hybrid Azure AD join, devices must have direct line of sight to a domain controller to complete the registration process. This allows them to retrieve the Service Connection Point (SCP) information from Active Directory, which directs them to the Azure AD tenant for registration. Without this connectivity, the device cannot find the necessary information to complete the join, resulting in a "Pending" state. Incorrect options: Windows activation is not a prerequisite for hybrid Azure AD join. User licenses for Microsoft 365 are not required for device registration itself, though they may be needed for accessing specific services. While keeping systems updated is good practice, it's not a direct requirement for the hybrid Azure AD join process to complete from a pending state.