Device Identity: Join, Register & Hybrid
Every device needs an identity in your cloud directory before you can manage it. Learn the three ways devices connect to Microsoft Entra ID — and when to use each one.
How do devices get an identity?
Think of Microsoft Entra ID as the building’s reception desk.
Before anyone can use the lifts, meeting rooms, or printers, they need a badge. Devices work the same way — they need an “identity badge” in your cloud directory before Intune can manage them.
There are three ways to get that badge:
- Entra Joined — the device lives in the cloud full-time (like a permanent employee badge)
- Entra Registered — the device just checks in occasionally (like a visitor pass for personal devices)
- Hybrid Joined — the device has badges for both on-prem Active Directory AND the cloud (like an employee who works in two offices)
The three join types
Sam Chen at Tui Solutions is migrating 500 devices from on-prem Active Directory to cloud-native management. His fleet includes corporate Windows laptops, shared tablets in the warehouse, and employees who occasionally use personal phones. Each device type needs a different approach.
| Feature | Entra Joined | Entra Registered | Hybrid Joined |
|---|---|---|---|
| Device ownership | Corporate-owned | Personal (BYOD) | Corporate-owned |
| Signed in with | Entra ID account | Personal account + work account added | On-prem AD account synced to Entra |
| On-prem AD required? | No | No | Yes |
| Supported OS | Windows 10/11, Windows Server 2019+ | Windows, iOS, Android, macOS | Windows 10/11, Windows Server |
| Full device management | Yes (Intune) | No (app-level only) | Yes (Intune + GPO) |
| Conditional Access support | Full | Limited | Full |
| SSO to cloud resources | Yes | Yes (for added account) | Yes |
| SSO to on-prem resources | Via cloud trust or Kerberos | No | Yes (native AD) |
| Best for | New cloud-first deployments | BYOD / personal devices | Migration from on-prem AD |
When to use which join type
Here’s Sam’s decision process for Tui Solutions:
New corporate laptops (ordered fresh, no existing AD relationship) → Entra Joined — these go straight to the cloud. No reason to touch on-prem AD.
Existing corporate laptops (currently domain-joined to on-prem AD) → Hybrid Joined — Sam can’t rip out on-prem AD overnight. Legacy apps still need Kerberos authentication. Hybrid join lets devices talk to both directories during migration.
Personal phones and tablets (employees checking email on their own devices) → Entra Registered — Sam doesn’t own these devices. Registration lets users access work apps while app protection policies keep corporate data safe.
Exam tip: the migration path
The exam loves to test when hybrid join makes sense vs pure Entra join. The key deciding factor is: does the organisation still rely on on-premises Active Directory for authentication or Group Policy?
- If yes → Hybrid Join (transitional)
- If no (or starting fresh) → Entra Joined (target state)
- Personal devices → always Entra Registered
Microsoft’s recommended end state is Entra Joined (cloud-native). Hybrid join is the bridge, not the destination.
How to join a device to Entra ID
Entra Join (corporate devices)
There are several ways to Entra-join a device:
- Windows OOBE (Out-of-Box Experience) — during first setup, user selects “Set up for an organisation” and signs in with Entra credentials
- Windows Settings — Settings → Accounts → Access work or school → Connect → Join this device to Microsoft Entra ID
- Windows Autopilot — fully automated join during device provisioning (covered in Module 8)
- Bulk enrollment — using a provisioning package for kiosk/shared devices
Entra Registration (personal devices)
- Windows Settings — Settings → Accounts → Access work or school → Connect (without selecting “Join”)
- Company Portal app — on iOS/Android, install Company Portal and sign in
- Microsoft Authenticator — on mobile devices, add a work account
Hybrid Join
- Entra Connect Sync — configure device writeback in Entra Connect
- Devices join on-prem AD normally → Entra Connect syncs the device object to Entra ID
- Requires Entra Connect (or Cloud Sync) with device sync enabled
Deep dive: Entra Connect vs Cloud Sync for hybrid join
For hybrid join, devices must be synced from on-prem AD to Entra ID:
- Entra Connect Sync — the original sync tool. Supports device writeback and hybrid join configuration. Requires an on-prem server.
- Entra Cloud Sync — lighter weight, agent-based. Supports hybrid join as of recent updates. Easier to set up for multi-forest environments.
Both achieve the same result: creating a device object in Entra ID that mirrors the on-prem AD computer object. The exam may ask about prerequisites — both require the device to have line-of-sight to a domain controller and internet access to reach Entra endpoints.
Real-world scenario: Sam’s migration plan
Sam’s approach at Tui Solutions (500 devices):
| Phase | Action | Join Type |
|---|---|---|
| Now | New laptops ship as Entra Joined via Autopilot | Entra Joined |
| Now | Existing laptops get Hybrid Joined via Entra Connect | Hybrid Joined |
| Now | Employee personal phones registered via Company Portal | Entra Registered |
| 6 months | Migrate legacy apps off Kerberos → modern auth | — |
| 12 months | Convert hybrid devices to Entra Joined (re-image or reset) | Entra Joined |
| End state | All corporate devices Entra Joined, BYOD registered | Cloud-native |
Key exam concept: Microsoft recommends moving toward cloud-native (Entra Joined) as the target state. Hybrid join is a transitional step for organisations that still depend on on-premises Active Directory.
🎬 Video walkthrough
Flashcards
Knowledge Check
Sam is setting up new laptops for Tui Solutions. The company has no on-premises Active Directory — everything is cloud-based. Which device join type should Sam use?
An employee at Tui Solutions wants to check work email on their personal iPhone. What's the appropriate Entra ID relationship for this device?
Chen Wei at Meridian Bank needs to manage 10,000 Windows devices that are currently joined to on-premises Active Directory. The bank still uses Kerberos authentication for several legacy financial applications. What join type should Chen Wei implement?
Next up: Build the Right Device Groups — organising your devices with dynamic membership, assigned groups, and filters.