They need to see the DC only the first time they register, after that the benefit of hybrid is that you do not have to be on-prem (including no need for VPN) to get SSO to cloud resources and be recognized as a corporates device.
They need to see the DC only the first time they register, after that the benefit of hybrid is that you do not have to be on-prem (including no need for VPN) to get SSO to cloud resources and be recognized as a corporates device.