Fix Autopilot Hybrid Join Error 0x80070774 During Initial Sign-In

Autopilot error 0x80070774 usually appears in a hybrid Microsoft Entra join deployment just before the first reboot or at the initial sign-in stage. The screen says something like Something went wrong. Confirm you are using the correct sign-in information and that your organization uses this feature. That message is vague, but Microsoft’s troubleshooting guidance is not: this failure normally means the hybrid join flow could not complete the offline domain join path it expected.

In practice, admins usually hit 0x80070774 for one of three reasons. The most common cause is that Assign user was enabled on a hybrid Autopilot profile, which forces a Microsoft Entra join step at the wrong time and leaves the device in a state that cannot complete on-premises domain join. The next most common causes are an Offline Domain Join connector problem or a deleted Microsoft Entra device object linked to the Autopilot record.

If you start with those checks, you can usually fix the issue without rebuilding your entire Autopilot design.

Quick Fix checklist

Run these checks in order before you wipe the device again:

Confirm the device is using a hybrid Microsoft Entra join Autopilot profile, not a standard Microsoft Entra join profile.
In the Autopilot device record, check whether Assign user is configured. If it is, remove the assigned user and retry.
Confirm the correct hybrid Autopilot profile is still assigned to the device.
On the server hosting the Intune Connector for Active Directory, review the ODJ Connector Service log for Event ID 30132.
Validate that the connector server can reach a domain controller and that the service account or connector computer has permission to create computer accounts in the target OU.
Check whether the Autopilot object still maps to a valid Microsoft Entra device. If the associated device object was deleted, delete the Autopilot record and reimport the hardware hash.
Re-run OOBE only after the tenant-side fix is complete.

That order matters because most 0x80070774 incidents are caused by profile design or connector-side prerequisites, not by a damaged Windows image.

What 0x80070774 actually means in Autopilot

Microsoft documents 0x80070774 as a hybrid Autopilot failure that typically occurs before the device restarts during the initial sign-in screen. The practical meaning is simple: the device could not complete the domain join dependency needed for hybrid enrollment.

The official Microsoft troubleshooting article calls out this root cause first:

Assign user is enabled in a hybrid Microsoft Entra Autopilot scenario.

That setting is valid in standard Microsoft Entra join scenarios, but Microsoft says it should not be used for hybrid join. When it is enabled, the device performs a Microsoft Entra join during the initial sign-in phase and lands in a state that cannot also complete the expected on-premises domain join sequence.

Microsoft also documents two more causes you should check quickly:

The domain controller cannot be found or reached during the join process.
The Autopilot object’s associated Microsoft Entra device was deleted and needs to be recreated by deleting and reimporting the Autopilot hardware hash.

Root Cause 1: Assign user is enabled on a hybrid Autopilot profile

This is the fastest high-value check. Microsoft explicitly says the Assign user feature should only be used in standard Microsoft Entra join Autopilot scenarios, not in hybrid Microsoft Entra join.

Why it breaks:

The hybrid flow expects the device to receive an offline domain join blob from the Intune Connector.
Assign user pushes the device into a Microsoft Entra join state during the initial sign-in screen.
The join state no longer matches what hybrid Autopilot needs, so the device cannot finish domain join and throws 0x80070774.

Fix

In Intune admin center:

Devices > Windows > Windows devices > select the affected device > ellipsis > Unassign user

Then verify the correct hybrid Microsoft Entra join Autopilot profile is assigned before you retry OOBE.

If you are using dynamic groups for profile targeting, confirm the device is not also landing in a conflicting Microsoft Entra join profile assignment. Hybrid Autopilot gets messy fast when multiple profile intents overlap.

Root Cause 2: The ODJ connector cannot create or return the offline domain join blob

If removing the user assignment does not fix the problem, move straight to the Offline Domain Join connector. Microsoft’s troubleshooting article says to check the ODJ Connector Service log for Event ID 30132.

That event usually points to one of these problems:

The connector server cannot reach a domain controller.
The connector computer or service account does not have enough rights in the target OU.
OU delegation was never completed correctly.
The connector can contact Intune, but cannot complete the on-premises account creation step.

Microsoft’s sample event text is specific:

Failed to get the ODJ Blob
The ODJ connector does not have sufficient privileges to complete the operation
DiagnosticCode: 0x00000800

Fix

Review OU delegation and connector prerequisites.

Microsoft’s hybrid Autopilot documentation says the connector needs permission to create computer accounts in the OU used for hybrid Autopilot devices. The least-privilege model is to delegate the needed rights on that OU instead of making the account a Domain Admin.

If you are using the connector computer account or a managed service account, verify:

The server hosting the connector can reach Active Directory and the internet.
The connector has Log On as a Service if a service account is in use.
The account or connector computer has permission to create computer objects in the target OU.
Standard RPC/DC communication to domain controllers is not blocked.

Root Cause 3: Domain controller reachability is failing during OOBE

Microsoft’s description of 0x80070774 also says the domain controller might not be found or reached successfully. Even if the connector is installed and healthy, hybrid Autopilot still depends on normal Active Directory communication and OU targeting.

Common causes here include:

Broken line-of-sight from the connector server to a DC.
DNS resolution issues for the domain.
Firewall rules blocking required AD or RPC traffic.
OU targeting or domain join configuration drift after an infrastructure change.

This is why 0x80070774 often appears after a network or identity change rather than after a Windows patch.

Root Cause 4: The Microsoft Entra device linked to the Autopilot record was deleted

Microsoft lists this as another possible cause. If the Autopilot object still exists but its associated Microsoft Entra device object was deleted, the hybrid enrollment relationship can break badly enough to stop provisioning.

Fix

Microsoft’s guidance is to:

Delete the affected Autopilot object.
Reimport the hardware hash.
Wait for the new record to process.
Reassign the correct hybrid profile.
Retry OOBE.

Do not do this as your first step. It is a cleanup action for a specific record-mapping problem, not the default fix for every hybrid join error.

Logs and where to check

When you need proof instead of guesswork, check these locations first.

On the Windows device

Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin

Also collect:

dsregcmd /status
mdmdiagnosticstool.exe -area "DeviceEnrollment;Autopilot" -zip "C:\Users\Public\Documents\MDMDiagReport.zip"

What you want to confirm:

The device is actually in a hybrid Autopilot flow.
The failure occurs before policy delivery fully starts.
The join state is incomplete or inconsistent.

On the Intune Connector for Active Directory server

Event Viewer > Applications and Services Logs > ODJ Connector Service

Look for:

Event ID 30132
Failed to get the ODJ Blob
The ODJ connector does not have sufficient privileges
Domain or OU references that identify the blocked step

In Intune admin center

Check:

Devices > Windows > Windows enrollment > Devices

And validate:

The device still has the correct Autopilot profile.
No conflicting profile assignment exists.
The device is not still carrying a stale assigned user for a hybrid profile.

PowerShell and Graph commands that help

Use these commands to prove the failure path faster.

1. Check join state on the device

dsregcmd /status

If the output shows a partial or failed join state, line that up with the OOBE failure timestamp.

2. Collect Autopilot and enrollment diagnostics

mdmdiagnosticstool.exe -area "DeviceEnrollment;Autopilot" -zip "C:\Users\Public\Documents\MDMDiagReport.zip"

3. Review recent ODJ connector errors

Get-WinEvent -LogName "ODJ Connector Service" -MaxEvents 20 |
  Select-Object TimeCreated, Id, LevelDisplayName, Message

4. Test domain controller discovery from the connector server

nltest /dsgetdc:contoso.com
Test-NetConnection dc1.contoso.com -Port 445

Replace contoso.com and dc1.contoso.com with your real domain and DC.

5. Confirm the Autopilot record still exists in Microsoft Graph PowerShell

Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"
$serial = "YOUR-SERIAL"
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
  Where-Object { $_.SerialNumber -eq $serial } |
  Select-Object Id, SerialNumber, GroupTag, PurchaseOrderIdentifier

This does not prove the linked Microsoft Entra device is healthy by itself, but it confirms the Autopilot identity still exists and gives you the record you need for deeper cleanup if Microsoft’s deleted-device scenario applies.

Step-by-step remediation workflow

Use this sequence for live incidents:

1. Confirm the design

Record the serial number, device name if available, assigned profile type, OU target, connector server name, and whether the issue affects one device or all hybrid devices.

If every new hybrid device is failing, suspect profile design or connector prerequisites first. If only one reused device is failing, also consider stale object mapping.

2. Remove assigned user from the hybrid device record

If Assign user is present, remove it and retry after the change finishes syncing.

3. Check the connector log immediately

On the connector server, inspect Event ID 30132. If you see permission-related blob failures, stop retesting devices and fix OU delegation first.

4. Validate connector-to-DC connectivity

Run DC discovery and port tests from the connector server. Confirm DNS resolution, firewall path, and AD access are still good.

5. Review OU delegation

Make sure the connector computer or service account can create and delete computer objects in the intended OU. Microsoft’s hybrid Autopilot guidance favors delegated OU permissions over excessive AD privilege.

6. Recreate the Autopilot record only if evidence supports it

If the device object mapping is broken or the associated Microsoft Entra device was deleted, delete the Autopilot object, reimport the hardware hash, let the new record sync, and then retry.

7. Re-test with one pilot device

Do not reopen the whole wave yet. Prove the fix with one known pilot device before moving additional hardware through OOBE.

Common admin mistakes behind 0x80070774

Treating it like a password or MFA issue

The sign-in message looks like an identity prompt failure, but Microsoft ties this error to the hybrid join workflow, not to normal user password troubleshooting.

Re-running OOBE repeatedly before fixing the connector

If Event ID 30132 is already telling you the ODJ blob cannot be created, another reset usually just burns more time.

Using Assign user because it works in cloud-only Autopilot

This is the biggest trap. Microsoft explicitly warns that it should not be used for hybrid join.

Granting broad domain admin rights instead of fixing OU delegation

That might get one test moving, but it is not the right long-term fix. Delegate the exact rights needed in the target OU.

Prevention checklist

Add these checks to your hybrid Autopilot runbook:

Keep Assign user disabled for hybrid Autopilot profiles.
Document which OU receives new hybrid Autopilot computer objects.
Monitor the ODJ Connector Service log after connector upgrades or AD changes.
Test domain controller discovery from the connector server after network segmentation changes.
Keep at least one clean pilot device for hybrid join validation.
Avoid deleting Microsoft Entra device objects casually when the Autopilot record is still in use.

Conclusion

Autopilot hybrid join error 0x80070774 is usually a workflow mismatch, not a mystery. Microsoft’s guidance narrows the fix path well: remove Assign user from hybrid profiles, check the ODJ connector for Event ID 30132, confirm OU delegation and DC reachability, and only then consider recreating the Autopilot record.

If you follow that order, 0x80070774 becomes a targeted hybrid join repair instead of a long OOBE guessing game.