3.2.3. Device Join and Registration
💡 First Principle: Devices get identities for the same reason users do: policy needs a trustworthy signal about the machine before it can require "compliant device" or grant SSO. The three relationship types encode ownership: personal devices register, corporate cloud devices join, and corporate AD devices hybrid join — and each unlocks different controls.
| Entra registered | Entra joined | Entra hybrid joined | |
|---|---|---|---|
| Ownership model | Personal / BYOD | Organization, cloud-first | Organization, AD-joined |
| User signs in with | Local/personal account (+ work account added) | Entra credentials | AD credentials |
| OS support | Windows, macOS, iOS, Android, Linux | Windows, (macOS via SSO extensions evolving) | Windows (domain-joined) |
| How it happens | Add work account / MDM enrollment | OOBE/Settings, Autopilot, bulk enrollment | Configured via Entra Connect + GPO/auto |
| Typical controls | App protection, CA device checks | Full Intune management, WHfB, SSO | Co-management, SSO to both worlds |
The pairing with Conditional Access is the point: "require compliant device" needs the device known to Entra and managed/evaluated by Intune (compliance flows from Intune to the device object); "require hybrid joined device" targets the AD-fleet pattern. Device settings from 3.1.3 govern who may join/register and how many devices per user; local administrator on Entra-joined machines defaults to the joining user plus roles you configure (and the LAPS successor for local admin passwords lives in this space). Devices support enable/disable (a disabled device fails device-based CA immediately — a fast containment lever) and BitLocker key escrow for joined devices.
Migration logic for stems: cloud-first org, new Windows fleet → Entra join (+ Autopilot); existing AD fleet needing cloud CA signals without re-imaging → hybrid join; contractors' personal phones → register (+ app protection policies), never join.
⚠️ Exam Trap: Hybrid join is not "better join" — it's the compatibility state for AD-domain-joined machines. Microsoft's direction (and modern-answer stems) prefer pure Entra join for new deployments; hybrid join answers stems that already have AD-joined devices to bring along.
Reflection Question: A CA policy requires compliant devices for Finance apps. A finance user's personal iPhone is registered but not enrolled in Intune. Walk through why the sign-in fails and the two different resolutions (device-side vs policy-side).