2.4MD-102Advanced
Est: ~15 mins•Verified: 2026-08

Device Identity: Entra Joined vs Hybrid vs Registered

Architecture, token flows, Primary Refresh Token (PRT), and troubleshooting for Microsoft Entra Joined, Hybrid Entra Joined, and Entra Registered states.

Tags:#Entra ID#Hybrid Join#PRT#dsregcmd#Identity#MD-102
01

Overview

Microsoft Entra ID recognizes three distinct device identity states for managing endpoint access to cloud resources:

  1. Microsoft Entra Joined: Modern, cloud-native devices joined exclusively to Microsoft Entra ID. No dependency on on-premises Active Directory Domain Services (AD DS). Users sign in with corporate cloud identities (user@company.com).
  2. Microsoft Entra Hybrid Joined: Devices joined to an on-premises Active Directory domain and registered with Microsoft Entra ID via Microsoft Entra Connect Sync or Cloud Sync. Users sign in using traditional Active Directory credentials (DOMAIN\user).
  3. Microsoft Entra Registered (Workplace Joined): Personally owned devices (BYOD) or mobile phones (iOS/Android/Windows) registered to Entra ID to receive a device identity for Conditional Access and Single Sign-On (SSO) without giving the organization full device management control.

All three states rely on the Primary Refresh Token (PRT) to enable seamless Single Sign-On across Microsoft 365, Teams, Edge, and SaaS applications.

---

02

When to Use

Identity StateTarget OwnershipAuth InfrastructureBest Used For
Microsoft Entra JoinedCorporate-owned100% Cloud (Entra ID)New PCs, remote workers, modern cloud-first enterprise strategy.
Microsoft Entra Hybrid JoinedCorporate-ownedOn-premises AD DS + Entra ConnectExisting enterprise fleets requiring legacy Kerberos/NTLM and on-prem Group Policies (GPO).
Microsoft Entra RegisteredPersonal / BYODUser Account BindingEmployee personal laptops, mobile phones accessing corporate email or Teams.

---

03

Prerequisites

Hybrid Entra Join Requirements:

  • Microsoft Entra Connect Sync (or Cloud Sync) running and synchronizing target computer Organizational Units (OUs).
  • Service Connection Point (SCP) configured in Active Directory Forest (CN=62a0ff2e-7647-40cc-8660-0080da87c424,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=domain,DC=com).
  • Line-of-sight to Domain Controllers (port 88 Kerberos, 389 LDAP, 445 SMB).
  • Outbound access from devices to:
  • https://enterpriseregistration.windows.net
  • https://login.microsoftonline.com
  • https://device.login.microsoftonline.com

---

04

Portal Path

TEXT
Microsoft Entra Admin Center (https://entra.microsoft.com)
└── Identity
    └── Devices
        ├── All devices (Inspect Join Type, MDM status, OS)
        └── Device settings (Device registration rules, Join limits)

---

05

Step-by-Step Implementation

Step 1: Verify Active Directory Service Connection Point (SCP)

In an elevated PowerShell prompt on a Domain Controller:

PowerShell
# Query existing SCP registered in the Active Directory Configuration partition
Get-ADServiceConnectionPoint -Filter "Name -eq 'DeviceRegistrationConfiguration'" -Properties * |
    Select-Object Name, DistinguishedName, Keywords

The Keywords property must contain:

  • azureADId:
  • azureADName:

Step 2: Configure Entra Connect Sync for Hybrid Join

  1. Open Microsoft Entra Connect setup wizard on the sync server.
  2. Select Configure device options > Click Next.
  3. Select Configure Hybrid Microsoft Entra join.
  4. Check Windows 10 or later domain-joined devices.
  5. Select your Active Directory forest, authentication service, and provide Enterprise Admin credentials to generate/update the SCP.
  6. Ensure the target Computer Organizational Units (OUs) are selected under sync filtering.

Step 3: Trigger Device Registration on Windows Endpoint

On the domain-joined client machine:

  1. Open Task Scheduler (taskschd.msc).
  2. Navigate to Microsoft > Windows > Workplace Join.
  3. Right-click Automatic-Device-Join task > Click Run.
  4. Alternatively, open elevated CMD and execute:
Command Prompt
dsregcmd /join

---

06

PowerShell Automation

Comprehensive Device Join Diagnostic (dsregcmd /status):

PowerShell
# Run on Windows 10/11 endpoint to inspect identity state
dsregcmd /status

Key Output Verification Parameters:

TEXT
+----------------------------------------------------------------------+
| Device State                                                         |
+----------------------------------------------------------------------+
             AzureAdJoined : YES
          EnterpriseJoined : NO
              DomainJoined : YES
                DomainName : CONTOSO
+----------------------------------------------------------------------+
| SSO State                                                            |
+----------------------------------------------------------------------+
                AzureAdPrt : YES
       AzureAdPrtAuthority : https://login.microsoftonline.com/...
+----------------------------------------------------------------------+

Unjoin a Corrupted Hybrid / Registered State:

PowerShell
# Elevated command to clear local registration state
dsregcmd /leave

# Clean cached discovery tokens and force re-discovery
dsregcmd /join /debug

---

07

Microsoft Graph Automation

Query Devices and Filter by Join Type (TrustType):

PowerShell
Connect-MgGraph -Scopes "Device.Read.All"

# List all Entra Hybrid Joined devices
Get-MgDevice -Filter "trustType eq 'ServerAd'" -All |
    Select-Object displayName, operatingSystem, isCompliant, approximateLastSignInDateTime |
    Format-Table -AutoSize

# List all Cloud-Native Entra Joined devices
Get-MgDevice -Filter "trustType eq 'AzureAd'" -All |
    Select-Object displayName, operatingSystem, isCompliant, approximateLastSignInDateTime

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/6 (0%)
dsregcmd /status confirms AzureAdJoined : YES (and DomainJoined : YES for Hybrid).
SSO State confirms AzureAdPrt : YES with a valid issuance timestamp.
Device appears in Microsoft Entra Admin Center with Join Type Microsoft Entra joined or Microsoft Entra hybrid joined.
MDM column in Entra ID displays Microsoft Intune.
User can sign in with cloud credentials and access Microsoft 365 services without MFA/password prompts.
In Local Certificate Store (certlm.msc), Personal > Certificates contains a certificate issued by MS-Organization-Access.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
User Device Registration Event LogEvent Viewer > Applications and Services Logs > Microsoft > Windows > User Device Registration > AdminThe primary diagnostic log for Hybrid Join failures, SCP lookup errors, and discovery timeouts.
AAD Token Broker Diagnostic LogApplications and Services Logs > Microsoft > Windows > AAD > OperationalRecords Primary Refresh Token (PRT) acquisition, broker exchange, and Cloud AP errors.
Kerberos Cloud Ticket Logklist (CLI command)Displays Cloud Kerberos Trust tickets used to access on-prem file shares from Entra joined PCs.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Event ID 304: Discovery failedEndpoint cannot resolve SCP in Active Directory or cannot contact enterpriseregistration.windows.net.1. Verify SCP in AD using Get-ADServiceConnectionPoint.
2. Test outbound firewall on port 443 to Microsoft endpoints.
AzureAdPrt : NOUser signed in with cached credentials before device registration finished, or TPM issue.1. Lock and unlock workstation with active network connection.
2. Check dsregcmd /status under Diagnostic Data for PRT failure details.
Dual Identity in Entra IDPC was hybrid joined while an existing Entra Registered record existed.Delete the older Entra Registered record; keep the Hybrid Joined record.
Device Pending State in EntraDevice object registered in cloud via task, but on-prem AD computer object has not synced via Entra Connect yet.Force Entra Connect sync on the server: Start-ADSyncSyncCycle -PolicyType Delta.

---

11

Production Best Practices

Production Best Practice

Cloud Kerberos Trust for Entra Joined PCs:

Entra Joined PCs can access on-premises file servers and printers without Hybrid Join! Deploy Microsoft Entra Kerberos Trust (Windows Server 2016+ KDC) to issue on-prem Kerberos tickets directly from the cloud PRT.

Security Caution

Do Not Hybrid Join VDI Non-Persistent Pools:

Non-persistent virtual desktop infrastructure (Citrix/Horizon/AVD) can cause thousands of orphaned computer objects in Entra ID. Use dedicated Entra Joined or single-session persistent pools instead.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. TrustType Mappings: In Graph/PowerShell, AzureAd = Entra Joined, ServerAd = Hybrid Entra Joined, Workplace = Entra Registered.
  2. Automatic Join Mechanism: Hybrid Join is triggered by the scheduled task Automatic-Device-Join running under the SYSTEM context.
  3. SCP Location: The Service Connection Point is stored in the Configuration partition of the Active Directory forest.

---

13

Official Documentation

PREVIOUS TOPIC2.3 Device Health Attestation & Defender Sensor OnboardingNEXT TOPIC3.1 Windows LAPS: Cloud-Native Local Admin Solution