There’s plenty to get confused about when your Windows computer is registered, fully joined, or fully enrolled in your company’s Azure AD tenant. On one end of the spectrum, you have a personally purchased laptop that just needs secure access to email and Teams, and on the other end you have a tightly managed corporate device where IT owns the configuration, software, and security policies.
If that personally owned computer “joins” the organization instead of just registering, you are effectively handing your device over for corporate management and policy enforcement. Many small and micro businesses are comfortable allowing limited “registered” devices for access, but they often draw the line at full joins or even any registration at all on personal PCs and iPhones for security and compliance reasons.
“Enrolled” goes a step beyond registration or join, placing the device under full endpoint management (Intune), where IT can push apps, enforce conditional access, and ensure the device stays compliant with company standards.
Table of Contents
Connect – Join – Register
All these phrases are essentially the same but it is possible they are not “enrolled”. The user account only need to enroll once. Logins going forward is simply identifying users.
Stop!
You can connect, join, or register unless you have a user account created in Microsoft 365 Admin Center.
What can both Business Basic and Business Premium Licenses both see from an IT administrator perspective?
Most novice users of Microsoft 365 use their https://admin.microsoft.com for adding and removing users. However, they may want to take their user management one step further and jump into https://aad.portal.azure.com/ to see what devices are registered or joined.
I don’t have access to these portals. How do know if my computer is joined to an organization?
- open elevated cmd on machine and run below command to check the status
“dsregcmd /status”
Where do I join my company’s computer to their organization?
It depends if you have new or existing computer. Follow one of two options below
Option 1) New Computer steps with an IT Support
Follow the below steps to let an IT individual access the computer:
- Unbox the laptop and connect to power
- Turn ON, Select language and region
- Select ” Set up for an organization”, type user’s email and password.
- Click next and complete the start-up process
- Open Edge internet browser
- Allow for remote access…
Option 2) Existing Computer Already logged into a Windows profile but there’s no IT
ProTip! Record your local login credentials before performing this setup.
When you start the process of Azure AD joins with Windows 10, there are two ways to achieve this. First, you can go to Settings –> Accounts –> Work Access and click on Join or Leave Azure AD link. Another way is to go to Settings –> System –> About and join Windows 10 machine to Azure AD.
- It will reveal the current user’s profile logged in. Not the Global Admin account that joined you
- It will also list email account “resources” that are also connected to the current Windows profile
Azure AD Device Registration vs Joined vs Enrolled is it just the beginning for actively managing, maintaining, and securing devices and users from threats.
Ok, I am ready for some next level administration
This is where all the policies are managed. It is also a good place to start communicating with Microsoft Support if you are stuck on something.
How do I know if users can enroll devices?
To manage devices in Intune, devices must first be enrolled in the Intune service. This requires the Intune Management (Mobile Device Management – MDM) application to be integrated into Azure AD. Both personally owned and corporate-owned devices can be enrolled for Intune management.
There are two ways to get devices enrolled in Intune:
- Users can self-enroll their Windows PCs
- Admins can configure policies to force automatic enrollment without any user involvement
Want the MS explanation? Click below…
Intune enrollment methods for Windows devices – Microsoft Intune | Microsoft Docs
Conditional Access?!?! Say What?
This requires the Intune Management (Mobile Device Management – MDM) application to be integrated into Azure AD. I will update the Conditional Access post at some point for making Conditional Access easier to understand. You can start setting up some Conditional Access policies like MFA illustrated below.
Azure Active Directory Device Settings
Lots of fun filled features in this section to make use of. I highlighted some limitations in feature for Business Basic licensed users.
Features for Business Basic and Premium Users
- Users may join devices to Azure AD
- Do you really want that?
- User may register devices to Azure AD
- I assume this is ok for most businesses but maybe MFA should be a part of the process
- Require MFA Authentication to register or join devices with Azure AD
- This requirement resonates with me and it should with you.
Features for Microsoft 365 Business Premium only
- Additional local administrators on all Azure AD joined devices
Azure AD Device Registration vs Joined vs Enrolled Summary
Azure AD:
