← cd ~/events
// events/305 · Hybrid join
Event ID 305Hybrid join authentication error
Records the error, sub-error and server error from the authentication phase of hybrid join, typically when getting a token from Entra ID or a federation server (WS-Trust).
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft-Windows-User Device Registration |
| Area | Hybrid join |
What to check
Check the federation service supports WS-Trust and its MEX endpoint, and that the device can reach login.microsoftonline.com in system context (including any proxy).
Codes you'll see in this event
| Code | Meaning |
|---|---|
0xcaa90017 | ERROR_ADAL_PROTOCOL_NOT_SUPPORTED: on-premises identity provider does not support WS-Trust. |
0xcaa82efd | ERROR_ADAL_INTERNET_CANNOT_CONNECT: cannot reach login.microsoftonline.com. |
0xcaa82f8f | ERROR_ADAL_INTERNET_SECURE_FAILURE: TLS certificate could not be validated; check clock skew. |
0xcaa20003 | ERROR_ADAL_SERVER_ERROR_INVALID_GRANT: SAML token from the federation server was not accepted. |
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 305 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 305
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Hybrid join events
- Event ID 304: Hybrid join failed (phase and error code)
- Event ID 307: Hybrid join failure event
- Event ID 201: Hybrid join discover phase error
- Event ID 204: Hybrid join join-phase error
- Event ID 220: Cannot read the computer object in Active Directory