Entra Join vs Hybrid Join vs Registered: Comparison

Three methods, three different management logics

On the ground, it's probably the most misunderstood question around Microsoft Entra ID: should I join a device, join it in hybrid mode, or simply register it? The choice is not cosmetic — it determines who has authority over the device, whether you can manage it from Intune, and what level of compliance you can enforce via conditional access.

This article details the three options — Microsoft Entra join, Microsoft Entra hybrid join and Registered (BYOD) — with the parameters to verify, control commands and pitfalls that cost the most time in production.

Microsoft Entra Join: the cloud-native device

An Entra joined device has no dependency on a local Active Directory. It authenticates directly against Entra ID and can be natively managed by Intune, without GPO (group policy objects) or domain controllers.

Before allowing your users to join their computers, several settings deserve your attention in Device settings:

• Users can join their device to Entra ID: enable for "All" or for a targeted group.
• Require multi-factor authentication (MFA) to join a device: recommended, and probably mandatory going forward given the evolution of Microsoft security policies.
• Maximum number of devices per user: the default value is 50, which is unmanageable. Reduce it to a reasonable value, for example 15 to 20.
• Local administrator role: by default, the Global Administrator role is added as a local administrator on the joined device, and the user performing the join as well. This second point is enabled by default — evaluate it according to your least privilege model.
• Microsoft Entra LAPS (Local Administrator Password Solution): enables rotation and synchronization of the local administrator password.
• Restrict BitLocker key recovery by end users: useful if the device changes hands or is stolen.

1dsregcmd /status

1Connect-MgGraph -Scopes "Device.Read.All"
2Get-MgDevice -Filter "displayName eq 'WS1'" | Select-Object DisplayName, TrustType, IsManaged, IsCompliant

Once the device is actually enrolled in Intune (not just joined to Entra ID), you get the complete toolkit: remote removal, wiping, forced synchronization, deployment of configuration profiles and compliance policies — without ever touching Active Directory or a GPO.

Microsoft Entra Hybrid Join: the bridge to Active Directory

The hybrid join targets environments where computers remain joined to a local Active Directory (AD DS while being synchronized to Entra ID to benefit from cloud SSO (Single Sign-On) and conditional access. It's a typical transition step, not a final management mode.

Two settings are essential, and many administrators only configure one:

1. In Microsoft Entra Connect, launch the device options configuration wizard, choose "Configure Entra hybrid join" (to be distinguished from "device write-back", which is more for reverse migration scenarios outside AD).
2. In a GPO applied to the OUs (organizational units) containing the affected computers: Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration > Register domain-joined computers as devices, enable it.

Once the GPO is changed, force its application:

1gpupdate /force

Essential point: on a hybrid device, the source of authority remains Active Directory. You see it in Entra ID, you can potentially associate it with a conditional access policy, but you continue to manage it via traditional tools — Active Directory Users and Computers, GPO. To regain control via Intune on this type of computer, you must implement co-management (co-management) with Configuration Manager, which is outside the scope of simple hybrid join.

To verify status on the client side:

1dsregcmd /status

This time look for AzureAdJoined : YES and DomainJoined : YES simultaneously — this is the signature of a successful hybrid join.

Registered: personal devices and BYOD

A Registered device is neither joined to Entra ID nor to Active Directory. It's the classic BYOD (Bring Your Own Device) scenario: personal smartphone, tablet, personal PC used to check work email.

As soon as a user tries to access enterprise resources (email, documents) from an unrecognized device, they are prompted to go through the Intune Company Portal application, available on the App Store or Play Store. Enrollment is limited to the application and its data — the operating system is never taken over by the administrator.

On the management side, the administrator has a limited but sufficient tool for BYOD:

• App Protection Policies to prevent copying and pasting business data to personal applications;
• Selective wipe in case of loss or theft — only business data and applications are deleted, never the user's personal photos or contacts.

To list registered devices via Microsoft Graph (minimum permission: Device.Read.All):

1Connect-MgGraph -Scopes "Device.Read.All"
2Get-MgDevice -Filter "trustType eq 'Workplace'" | Select-Object DisplayName, TrustType, ApproximateLastSignInDateTime

Comparison table of the three methods

Common pitfalls and checks not to forget

• Device appears "joined" but remains unmanageable in Intune: verify the user's Intune/EMS license and automatic MDM enrollment (Intune > Devices > Enrollment).
• Hybrid join never triggers: check that the GPO "Register domain-joined computers as devices" is properly applied with gpresult /r, and that gpupdate /force has been run on target computers.
• Confusion between hybrid join and device write-back: these are two distinct options in the Microsoft Entra Connect wizard. Write-back is for scenarios where devices exist first in Entra ID and must appear in AD, not the other way around.
• New parameter "Disable MDM enrollment when adding a work or school account": useful for blocking unwanted mass enrollment during large-scale Autopilot deployment, but enable with discernment — it cuts automatic enrollment for all account sign-in scenarios, not just the targeted deployment.
• Underestimated hybrid propagation delay: do not diagnose a failure until several hours have elapsed and you have verified the synchronization health status in Microsoft Entra Connect Health.

For more information on synchronization mechanisms and detailed prerequisites, the official documentation on the device join concept in Microsoft Entra and on Entra hybrid join remains the up-to-date reference.

Key points to remember

• Entra Join is suitable for cloud-native devices: complete management via Intune, without AD, ideal for Autopilot.
• Hybrid Join is a transition step: the device is visible in Entra ID but remains managed by AD/GPO, unless co-management is implemented.
• Registered covers BYOD: only business applications are managed, never the entire operating system.
• In all three cases, systematically verify the user license, the status via dsregcmd /status, and propagation delays before concluding that a configuration has failed.