0x801c001d is the documented result of a failed AD Configuration Test in dsregcmd /status:
the Service Connection Point (SCP) object in the on-premises Active Directory forest is not
configured properly. Domain-joined devices read the SCP to learn which Microsoft Entra tenant to
register with. Without a correct one, hybrid join aborts in the discover phase on every device in
the forest at once.
0x801C001D
Service Connection Point is missing or wrong
What it means
Common causes
No SCP object exists in the forest — hybrid join was never fully configured, or the configuration was reverted.
The SCP names the wrong tenant ID or the wrong verified domain name.
The device is in a forest or domain that the SCP does not cover, so it never finds one.
Devices read the SCP from a domain controller that hasn't replicated the change yet.
How to fix it
On an affected device, run
dsregcmd /statuselevated and confirm AD Configuration Test : FAIL — that isolates the SCP as the cause rather than a network problem.Re-run the Microsoft Entra Connect Configure device options wizard to create or correct the SCP, which writes it with the right tenant ID and verified domain.
Verify the SCP directly: it lives under the Configuration naming context, and its keywords list the tenant ID and the verified domain name. Compare both against the tenant you intend to join.
Allow AD replication to complete before retesting, and test against more than one domain controller.
Frequently asked
Does the SCP have to exist for Microsoft Entra join?
No — only for hybrid join. A device that joins Entra ID directly (not domain joined) never reads the SCP. If you see this error, the device is domain joined and trying to hybrid join.