Microsoft Entra joined devices

Any organization can deploy Microsoft Entra joined devices no matter the size or industry. Microsoft Entra join works even in hybrid environments, enabling access to both cloud and on-premises apps and resources.

You sign in to Microsoft Entra joined devices using a Microsoft Entra account. Access to resources can be controlled based on your account and Conditional Access policies applied to the device.

Administrators can secure and further control Microsoft Entra joined devices using Mobile Device Management (MDM) tools like Microsoft Intune or in co-management scenarios using Microsoft Configuration Manager. These tools provide a means to enforce organization-required configurations like:

• Requiring storage to be encrypted
• Password complexity
• Software installation
• Software updates

Administrators can make organization applications available to Microsoft Entra joined devices using Configuration Manager to Manage apps from the Microsoft Store for Business and Education.

Microsoft Entra join can be accomplished using self-service options like the Out of Box Experience (OOBE), bulk enrollment, Apple Automated Device Enrollment (public preview), or Windows Autopilot.

Microsoft Entra joined devices can still maintain single sign-on access to on-premises resources when they are on the organization's network. Devices that are Microsoft Entra joined can still authenticate to on-premises servers like file, print, and other applications.

Scenarios

Microsoft Entra join can be used in various scenarios like:

• You want to transition to cloud-based infrastructure using Microsoft Entra ID and MDM like Intune.
• You can't use an on-premises domain join, for example, if you need to get mobile devices such as tablets and phones under control.
• Your users primarily need to access Microsoft 365 or other software as a service (SaaS) apps integrated with Microsoft Entra ID.
• You want to manage a group of users in Microsoft Entra ID instead of in Active Directory. This scenario can apply, for example, to seasonal workers, contractors, or students.
• You want to provide joining capabilities to workers who work from home or are in remote branch offices with limited on-premises infrastructure.

You can configure Microsoft Entra join for all Windows 11 and Windows 10 devices except for Home editions.

The goal of Microsoft Entra joined devices is to simplify:

• Windows and macOS deployments of work-owned devices
• Access to organizational apps and resources from any Windows or macOS device
• Cloud-based management of work-owned devices
• Users to sign in to their devices with their Microsoft Entra ID or synced Active Directory work or school accounts.

Microsoft Entra join can be deployed by using any of the following methods:

• Windows Autopilot
• Bulk deployment
• Self-service experience
• Apple Automated Device Enrollment (public preview)

Related content

• Plan your Microsoft Entra join implementation
• Co-management using Configuration Manager and Microsoft Intune
• How to manage the local administrators group on Microsoft Entra joined devices
• Manage device identities
• Manage stale devices in Microsoft Entra ID
• macOS Platform Single Sign-on (preview)