Entra join, registration and Intune enrollment
Before Intune can manage a device, the device needs an identity in Microsoft Entra ID and an enrollment in Intune. The exam often asks which join state fits a scenario.
Three device identity states
| State | Typical device | Sign-in | Notes |
|---|---|---|---|
| Microsoft Entra joined (formerly Azure AD joined) | Company-owned, cloud only | Work account | No on-premises AD needed |
| Microsoft Entra hybrid joined | Company-owned, existing domain | AD DS account | Needs Microsoft Entra Connect |
| Microsoft Entra registered | Personal or BYOD | Local or personal account | Work account added to apps |
If the scenario says “personal device”, think registered. If it says “no on-premises infrastructure”, think Entra join. If it says “already domain joined”, think hybrid.
Who can join
In the Microsoft Entra admin center, Devices > Device settings controls:
- Users may join devices to Microsoft Entra: All, Selected or None.
- Maximum number of devices per user.
- Whether joining requires multifactor authentication.
A device enrollment manager (DEM) account in Intune can enroll many more devices than the normal per-user limit.
Automatic MDM enrollment
Join does not enroll by itself. Under Entra ID > Mobility (MDM and MAM), select Microsoft Intune and set the MDM user scope to All or Some (a group). With the scope set, a device that joins is enrolled automatically. The MAM user scope applies app protection to devices that are not enrolled. If a user is in both scopes, MDM wins for Windows devices.
Enrollment restrictions
Intune has two kinds of restriction, both under Devices > Enrollment:
- Device type restrictions allow or block platforms (Windows, iOS, Android device administrator, Android Enterprise work profile, macOS), set minimum and maximum OS versions, and can block personally owned devices.
- Device limit restrictions set how many devices a user can enroll (1 to 15).
Restrictions are evaluated by priority. The lowest number wins, and the default restriction applies to everyone not matched.
Cleanup
A device cleanup rule (Devices > Device clean-up rules) deletes devices that have not checked in for a set number of days. Use it instead of removing stale devices by hand.
Exam traps
- Entra join and Intune enrollment are separate steps. The MDM user scope links them.
- Restricting who can join is in Entra Device settings, not in Intune enrollment restrictions.
- Hybrid join needs on-premises AD DS. Entra join does not.
- Azure AD join is the old name of Microsoft Entra join. Treat them as the same.
- A device limit restriction does not apply to a DEM account.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Only members of a group named PilotUsers may join Windows devices to the tenant. Where do you configure this?
Show answer
Answer: A.Device settings has "Users may join devices to Microsoft Entra" with the options All, Selected or None.
2. Employees use their own Windows laptops. They sign in with a personal local account but want to open company apps with their work account. Which state fits?
Show answer
Answer: C.Microsoft Entra registered is for personal (BYOD) devices where the user keeps their own local sign-in.
3. A company has an on-premises Active Directory and wants existing domain-joined PCs to also appear in Microsoft Entra ID. What do you use?
Show answer
Answer: B.Hybrid join keeps the device joined to AD DS and registers it in Entra ID through Microsoft Entra Connect.
4. You want only Android work profile devices to be able to enroll, and block Android device administrator. Which feature do you use?
Show answer
Answer: B.Platform settings in device enrollment restrictions allow or block each platform and ownership type.