Entra Registered vs Joined vs Hybrid Joined, Explained

Three desks, three laptops: same Windows, same Start menu, same apps. But open the Microsoft Entra admin center and each one shows a different join type: Microsoft Entra registered, Microsoft Entra joined and Microsoft Entra hybrid joined. Three names that sound almost the same, for three very different relationships between a device and your company.

Why a device needs an identity

Microsoft Intune is built on Microsoft Entra ID. Policies, apps and compliance rules are assigned to identities. People have one, their work account, and devices get one too.

When a device connects to Entra, Entra creates a device object for it, like an ID badge. It carries a unique device ID, the join type, who owns the device and which operating system it runs. That badge gets checked all the time:

• Conditional Access looks at it before letting you into email or Teams.
• Intune uses it to put the device in the right groups, so it gets the right policies and apps.
• It’s part of what gives you single sign-on.

There are three ways to get that badge, and a single company can use all three at the same time.

Microsoft Entra registered: the visitor pass

The lightest of the three, made for personal devices (BYOD) and for phones and tablets. The device belongs to the user, who signs in to it with a local or personal Microsoft account, then adds a work account on top:

• On Windows: Settings > Accounts > Access work or school, or the first time they open a work app.
• On a Mac: through the Company Portal app.
• It works on Windows, macOS, iOS, Android and some Linux editions.

You get single sign-on to cloud apps and a device that Conditional Access can recognize. But registered isn’t the same as managed: registration only gives the device an identity. Management comes separately, either by also enrolling the device in Intune or by protecting just the work apps with app protection policies.

• Pros: quick, light, and the owner stays in control.
• Cons: nobody signs in to the device with a work account, and IT gets the least control.

iPhones and Android phones can only be registered. Joined and hybrid joined are for computers.

Microsoft Entra joined: the staff badge

The device belongs to the company and its identity lives entirely in the cloud. You sign in to the device itself with your work account, the same one you use for email and Teams.

A device is usually joined during Windows setup (“Set up for work or school”), through Windows Autopilot or bulk enrollment, or later from Settings. With automatic enrollment turned on, it lands in Intune at the same time. It works on Windows 10 and 11 except Home, and newer options let you join Macs and some Linux editions too.

The big advantage: no on-premises Active Directory in the picture. No domain controller and no VPN just to sign in, so a new laptop can ship to someone’s home and set itself up there. You still get single sign-on, Windows Hello for Business, and even office file shares and printers when the device can reach a domain controller.

The trade-offs:

• Group Policy doesn’t apply, so you manage these devices with Intune.
• Older apps that need an Active Directory computer account won’t work.
• You can’t deploy them from a classic Sysprep image.

Microsoft calls Entra join the default choice for new and reset devices.

Microsoft Entra hybrid joined: two badges

For organizations that already run Active Directory on premises, often with a whole fleet of domain-joined PCs. The PC joins the domain the classic way, then Microsoft Entra Connect or Cloud Sync copies the computer to Entra and the device registers itself. It now has two identities, and users sign in with their organizational account like before. It works on Windows 10 and 11 except Home, and on Windows Server 2016 to 2022.

Why choose it? Nothing on premises breaks: Group Policy, existing imaging, Configuration Manager and co-management, and apps that need an AD computer account all keep working, and you get Conditional Access, single sign-on and Intune on top.

The cost: the device needs to reach a domain controller from time to time, or things like password changes start to fail and remote users may need a VPN to sign in. There are more moving parts (the sync) and two places to check when something breaks. Microsoft describes hybrid join as an interim step on the road to Entra join, not recommended for new devices, Autopilot included.

Side by side

	Registered	Joined	Hybrid joined
Owner	Usually the user	Company	Company
Sign in to the device with	Personal or local account	Entra work account	AD account synced to Entra
Needs on-premises AD	No	No	Yes
Group Policy	No	No	Yes
Full Intune management	Only if the user also enrolls	Yes	Yes
Platforms	Phones, tablets, computers	Windows (newer options for Mac, Linux)	Windows only

To check a device, look at the Join type column in the Entra admin center, or run this on Windows:

dsregcmd /status

• AzureAdJoined: YES means joined.
• AzureAdJoined: YES and DomainJoined: YES means hybrid joined.
• WorkplaceJoined: YES means the user registered the device.

Which one should you pick?

Start with one question: who owns the device?

• Personal: register it. The user keeps their device; protect work data with app protection policies, or enrollment if they agree.
• Company-owned and new: join it to Microsoft Entra. It’s the cloud-native path and Microsoft’s default for new and reset devices.
• Existing domain PC that still depends on on-premises resources: hybrid join gets it into the cloud today without breaking what works. Plan the move to Entra join at a natural moment, like a hardware refresh, because getting there means resetting the device.

A visitor pass, a staff badge or two badges. Which join type does your company use, and why? Tell me in the comments.