Library / Entra join, hybrid join & MDM
Entra join vs hybrid join vs registered: which one and when
The three ways Windows devices relate to Microsoft Entra ID, how each is managed, and why Microsoft recommends Entra join for new devices.
The three device identities
| Entra joined | Entra hybrid joined | Entra registered | |
|---|---|---|---|
| Joined to on-premises AD | No | Yes | No |
| Sign-in with | Entra ID account | AD account (synced) | Personal account |
| Typical management | Intune (MDM) | Group Policy, Configuration Manager and/or Intune | Intune app protection or MDM |
| Best for | New corporate devices | Devices with hard AD dependencies | BYOD and personal devices |
What Microsoft recommends
Microsoft recommends deploying new devices as cloud-native with Entra join, managed by Intune and provisioned with Windows Autopilot. Hybrid join through Autopilot is still supported but adds complexity, because the device must reach a domain controller during setup.
“But we still need file shares and on-premises apps”
Entra joined devices can still reach on-premises resources with single sign-on when you use:
- Windows Hello for Business with Cloud Kerberos Trust for Kerberos tickets to on-premises resources.
- Entra Connect or Cloud Sync so the same user exists in both directories.
- Line of sight to a domain controller (on site or via VPN) when accessing those resources.
Moving from hybrid to Entra join
There’s no in-place conversion. The usual path is to reset or replace devices with Autopilot during the normal hardware refresh cycle.
Checks for a new admin
dsregcmd /statusshows the join state (look for AzureAdJoined and DomainJoined).- In the Entra admin center, check the device’s Join type.
- In Intune, confirm the device is compliant, so Conditional Access allows it.
Official docs: Entra device identity and Windows Autopilot.