Discovery credentials for Windows Autopilot workstations Azure AD joined

[cynlink1]

We have Windows Autopilot workstations joined to Azure AD only. These devices have NO network line of sight to our on-premises domain controllers so it is not possible to use a domain service account for credentials. We set up a service account in Azure AD for the purposes of performing Discovery. However, the credentials are failing regardless of the format we use. Is it possible to set up credentials using an Azure AD service account to run Discovery on Azure AD joined workstations? If yes, what is the format? If not, is our only alternative to use a local admin user account?

[Rahul Priyadars]

I am Confused ..

Service Now can do SSO with Azure AD - Correct

So i am wondering why Azure AD admin user can not be used for IP based Discovery....Conceptually i am unable to digest.

Regards

RP

[cynlink1]

In our case, SSO works with an on-premises Active Directory domain. Active Directory Domain Services directory synchronizes with Azure AD to enable it to authenticate on-premises users for Office 365. 

The Windows AutoPilot workstations are not joined to the local (on-premise) domain.

They are Azure AD joined and managed in Microsoft Intune - Endpoint Management.

The MID Servers joined to the local domain.

Does this information help clarify?

[Georgi2]

Anyone has an answer here? We are running into the same where Azure AD Joined computers we can't use local admin credentials to discover them. Keep running into access denied.

[Steven Parker]

Did you ever find a solution for this?  We just placed some device objects in Azure AD created a local admin on them, but ServiceNow instance can't discover them using the Windows credential we created.  Running discovery it sees the devices as active but no valid credential.

[pratik0306]

is the MID in same domain as the computers in question?

You can try for the option of gMSA as well if that is permissible