The IT landscape has changed significantly in recent years. While companies used to have their entire IT infrastructure On-premise, i.e. operated in their own data centers, today more and more organizations are setting up Cloud solutions or hybrid models. This also applies to identity and device management
Microsoft Entra ID has established itself as a central platform for modern identity and access management. It enables secure authentication and authorization across different devices and services. A crucial aspect of using Entra ID is how devices are integrated — because the various join types define how trust and connectivity are created within the Entra environment.
Companies must therefore ask themselves fundamental questions:
- Should they continue to classically use their devices in a On-premise Active Directory (AD) domain manage?
- Is a hybrid solution A good middle ground for using both local and cloud resources?
- Or should they completely take the step into the cloud and just Microsoft Entra ID (formerly Azure AD) use it for their identity management?
Each of these options has their own Pros and cons, which differ significantly in terms of management, security, and user experience. In this article, we'll take a detailed look at the differences between On-premise and cloud as well as on the various Entra ID join types in Microsoft Entra ID.
The most important things in brief
Join types follow the infrastructure strategy: Whether on-premise, hybrid or cloud — choosing the right device join type depends largely on the company's IT model.
Four join models at a glance:
▸ Domain Joined: for classic on-premise infrastructures
▸ Hybrid Joined: if local resources are to be retained
▸ Entra Joined: for cloud-native devices (Microsoft recommendation for new devices)
▸ Entra Registered: for BYOD or private devices with access to corporate resources
Cloud native endpoints in focus: New functions are primarily being developed for ENTRA-only devices. A later switch from AD/hybrid models is only possible through Wipe.
Security & Management: Microsoft Entra ID offers centralized management functions, modern authentication (SSO, conditional access) and supports zero trust architectures.
We'll help you choose and migrate the right join type — with a focus on modern cloud native endpoints, but without forgetting our roots in AD.
1. On-premise, cloud or hybrid — and what that means for device join
The choice of the appropriate device join type depends largely on how a company's IT infrastructure is structured: local, cloud-based or hybrid. The join type defines how devices are integrated into identity management — and must fit the environment.
- For purely local environments With classic Active Directory and file servers, Domain Join is standard.
- hybrid scenarios, which include cloud services, usually require a hybrid join.
- Cloud-native companies, who rely entirely on Entra ID, can manage their devices directly via Entra Join.
The fundamental differences between on-premise and cloud relate to infrastructure, costs, scalability and security model — and thus form the basis for technical implementation in device management:
- Infrastructure & Management: On-premise means complete control, but also responsibility. In the cloud, updates, backups and scaling are automatically carried out by the provider.
- Cost structure: While on-premise requires high initial investments, the cloud offers a flexible pay-as-you-go model.
- scalability: Cloud solutions can be adapted quickly — on-premise often takes weeks or months.
- Security & Compliance: Both models are secure, but regulated differently — particularly when it comes to data protection.
- Access & mobility: Cloud solutions support remote work and mobile access without a VPN connection.
2. Introduction to device Types
When moving from an on-premise environment to a hybrid or fully cloud-based infrastructure, the question is how devices should be managed in the future. Microsoft Entra ID (formerly Azure AD) supports several types of device operations, each covering specific requirements and usage scenarios:
- Active Directory Domain Joined Devices (local, on-premise)
- Microsoft Entra Hybrid Joined Devices (local and cloud)
- Microsoft Entra Joined Devices (Cloud-only)
- Microsoft Entra Registered Devices (for BYOD and private devices)
The type of join you choose determines how devices are integrated into identity management — and has a direct impact on security, user experience, and management effort.
For end users, hardly any difference may be visible — for administrators, however, choosing the right type of join is a central element of any IT strategy. Depending on whether an infrastructure is on-premise, cloud-based or hybrid, different models are suitable for connecting devices.
A hybrid join is often seen as a practical intermediate step because it combines existing on-prem structures with modern cloud functions. In purely cloud-based environments, Entra Join offers a lean, fully manageable solution. BYOD scenarios, in turn, can be mapped with Entra Registered Devices.
The differences — and what they mean for management, security, and authentication — are explained in the next chapter.
{{Why-hybrid-joined=” /dev/components "}}
2.1 Microsoft Entra Registered Devices
Microsoft Entra Registered Devices are devices that are linked to a Microsoft Entra ID tenant but are not a member of a domain. These devices are usually personally managed and often come in Bring Your Own Device (BYOD) scenarios for use where employees use their own devices to access corporate resources.
Features:
- These devices are particularly suitable for employees who use private devices for professional purposes.
- They provide access to Microsoft Entra ID resources, but with limited management by the IT department.
- Compared to Microsoft Entra Joined or Hybrid Joined Devices, administrative control options are limited.
- Because these devices aren't joined to a domain, security and access control is less comprehensive than fully managed devices.
Authentication technology:
Use Microsoft Entra Registered Devices CloudAP (cloud authentication provider) for authentication. CloudAP is Microsoft Entra ID's authentication service that verifies users and devices when accessing cloud-based corporate resources.
Deployment scenario:
These devices are ideal for companies with a flexible BYOD Strategy, which allow their employees to access corporate resources from private devices without fully integrating them into the corporate network.
{{cta-box=” /dev/components "}}
2.2 Microsoft Entra Join Devices
Microsoft Entra Joined Devices — also as Cloud native endpoints referred to — are devices that are completely in Microsoft Entra ID are integrated without connection to a local Active Directory (AD). They are designed for companies that consistently implement their IT environment Cloud-first set up or have already completely migrated to the cloud.
Microsoft itself is recommending this approach for new devices today. For classic On-premise clients and Hybrid Joined Devices is no significant development More planned — new features are being developed specifically for cloud native endpoints.
Features:
- Devices are fully managed via Microsoft Entra ID — without a connection to a local AD.
- Modern features such as Single sign-on, Conditional Access, Self-service password reset or Remote Deployment can be used directly.
- No VPN required: Users can easily use cloud resources such as Microsoft 365, Azure services, and SaaS applications.
- No access to traditional on-prem resources such as network drives or GPOs.
- Maximum independence from local infrastructure — ideal for mobile and distributed workplaces.
Authentication technology:
Microsoft Entra Joined devices use the Web Account Manager (WAM) for authentication. WAM provides a seamless SSO experience with Microsoft services without users having to sign in multiple times — including token handling and MFA support via Entra ID.
Deployment scenario:
This join variant is particularly suitable for companies that no longer need a local Active Directory infrastructure — or want to actively replace it. Entra joined devices are the basis for modern, cloud-based endpoint management.
Important to know: The subsequent migration from a hybrid or on-prem model to cloud native is only possible by completely resetting (wipe) the devices. Entra Join should therefore be included in device and rollout strategies at an early stage — e.g. as part of planned migrations or hardware cycles.
Learn more: Microsoft Learn — Cloud Native Endpoints
2.3 Microsoft Entra Hybrid Joined Devices
Microsoft Entra Hybrid Joined Devices are devices that are connected to a local Active Directory (AD) and Microsoft Entra ID at the same time. This hybrid solution is particularly suitable for companies that want to maintain their existing on-premise infrastructure but gradually integrate cloud services.
Features:
- These devices provide seamless authentication via single sign-on (SSO), for both cloud and on-premise resources.
- Existing group policies (GPOs) and other local identity management features will continue to be retained. This allows IT departments to maintain familiar security and management policies.
- Hybrid joined devices are a required solution for companies that still use on-premise applications and servers but want to benefit from cloud services at the same time.
- Synchronization between local AD and Microsoft Entra ID requires Microsoft Entra Connect to manage user and device accounts across both systems.
- Because these devices use two identity systems at the same time, managing them is more complex than purely cloud-based solutions.
Deployment scenario:
Microsoft Entra Hybrid Joined Devices are ideal for companies that have an existing on-premise infrastructure but want to introduce cloud services step by step. This solution allows companies to continue using local resources while integrating the benefits of Microsoft Entra ID and modern cloud services.
3. Comparison of Entra ID device join types
4. Conclusion
Choosing the right Microsoft Entra Device Join type is crucial for efficient and secure IT management. Identity and Access Management is at the heart of a zero trust architecture. Every company has different identity requirements — and Device Management which vary based on device ownership, management requirements, and integration with Microsoft Entra ID services.
It is important to note that the various join types are not mutually exclusive — quite the opposite. They can be combined to meet different device categories and usage scenarios:
- Microsoft Entra Registered Devices are particularly suitable for private devices as part of a BYOD strategy. They provide access to corporate resources without the need for these devices to be fully managed by IT.
- Microsoft Entra Joined Devices offer completely cloud-based management and are ideal for devices that only use cloud resources — such as in modern, location-independent work environments.
- Microsoft Entra Hybrid Joined Devices connect the local Active Directory to Microsoft Entra ID. They are useful for devices that still need access to on-premise resources, such as network drives or local applications — and should be able to be integrated with cloud services at the same time.
Choosing the right model should always be in line with the company's IT strategy. Companies that continue to rely on local AD resources benefit from a hybrid solution, while companies seeking full cloud transformation make the best choice with Microsoft Entra Joined Devices.
Implementing the right solution can be complex, particularly when it comes to migrating existing structures and ensuring security policies.
SOFTTAILOR is your partnerto help your company with Planning, implementation and optimization The Microsoft Entra ID Strategy to support. Schedule your first free consultation now here.
Dorian has been involved in corporate and IT strategy since 2011. Due to the endpoint security deficiencies of many companies and the information overload, he developed the endpoint strategy. Dorian is co-founder of the “Endpoint Management” expert group at IAMCP e.V.
Jahre Erfarung
Verwaltete Endgeräte
