The group policy object Register domain-joined computers as devices, or Automatically workplace join client computers in older templates, was previously a requirement for enabling Hybrid Azure AD Join. After configuring Azure AD Connect and your Seamless SSO GPOs, this had to be enabled.
Since Windows 10 1607 (“Anniversary Update”), in Azure AD Connect environments, on-premises Active Directory joined computers become Azure Active Directory registered when a synchronised user signs in to a synchronised computer; regardless of the GPO existing. Prior to this, on Windows 10 1511 (“November Update”) and before, only if this GPO, or other configuration to create this registry value, was used.
Okay, but there’s a disabled setting too; is that applicable from 1607 on? There is (at time of writing) an ongoing discussion about this on Github but it looks like this setting does not work – it will not block devices from HAADJ – and the problem is acknowledged by the product team. The workaround seems a major inconvenience, effectively disabling HAADJ across the board then pushing out a registry to devices you want it applied to.
