Week 1: Every device needs an identity

Why a device needs an identity

Microsoft Entra ID (the cloud directory behind Microsoft 365) already knows your users. Giving the device an object there too unlocks a lot: sign-in policies can check which device someone uses, users get single sign-on to cloud apps, and later Intune can hang compliance, BitLocker keys and local admin passwords on that object. No device identity, no device-based rules.

Dev: Users prove who they are. Device identity proves what they're holding.

Registered, joined, hybrid joined

Microsoft Entra registered: a personal device (BYOD). The owner keeps signing in with their own account and just adds a work account. Microsoft Entra joined: a company Windows device. Users sign in to Windows with their work account, and no on-premises domain is needed. Microsoft Entra hybrid joined: a PC joined to on-premises Active Directory that is also synced into Entra ID, for companies that still rely on the domain.

Exam tip Trap: "registered" is for devices the company does NOT own. A brand-new company laptop should be joined, not registered.

Choosing the join type

Ask two questions: who owns the device, and does it still need the old domain? Personal phone or home PC: registered. New company Windows PC with cloud apps: joined (Microsoft's recommended default). Existing domain PC that still needs Group Policy or on-premises sign-in: hybrid joined, which needs Microsoft Entra Connect to sync the computer object.

Device                 Join type
Rosa's own iPhone      Entra registered
New warehouse laptop   Entra joined
Old finance PC (GPO)   Entra hybrid joined
Sam's home PC          Entra registered

Exam tip Entra registered works on Windows, macOS, iOS/iPadOS and Android. Joined and hybrid joined are for Windows devices.

Joining a Windows device

Two ways. During setup (OOBE), choose the work or school option and sign in with a work account. On a running PC: Settings > Accounts > Access work or school > Connect, then pick Join this device to Microsoft Entra ID. Whoever is allowed is set in the Microsoft Entra admin center under Devices > Device settings: Users may join devices to Microsoft Entra ID can be All, Selected or None.

Exam tip Mass rollouts use Windows Autopilot instead of hand-joining. That's month two.

Registering a personal device

On Windows, the owner opens Access work or school > Connect and signs in, without choosing the join option. On iPhone or Android, signing in to a work app through a broker app (Microsoft Authenticator, or Company Portal on Android) registers the device. Registration alone is not management: Intune enrollment is a separate step, although Windows can enroll automatically when it joins or registers.

Exam tip Registered = Entra knows the device. Enrolled = Intune manages the device. The exam loves to swap them.

Proof on the device: dsregcmd /status

On Windows, dsregcmd /status shows the device's join state. AzureAdJoined YES means Entra joined. DomainJoined YES plus AzureAdJoined YES means hybrid joined. WorkplaceJoined YES on a device that isn't joined means registered.

C:\> dsregcmd /status
+-------------------------------------+
| Device State                        |
+-------------------------------------+
     AzureAdJoined : YES
  EnterpriseJoined : NO
      DomainJoined : NO
       DeviceName : KC-LT-0143

Exam tip Older tools and attributes still say AzureAD. The deviceTrustType values are AzureAD (joined), ServerAD (hybrid) and Workplace (registered).

Who becomes local admin on a joined PC

When a device is Entra joined, Windows adds the Global Administrator role and the Microsoft Entra Joined Device Local Administrator role to the local Administrators group. By default the user who joins the device also becomes a local admin, which an Entra device setting can turn off. Autopilot can make users standard users instead.

Exam tip Kibble's goal: users run as standard users. Local admin control comes back in week 3 with LAPS and local group policies.

Assigned vs dynamic groups

Intune targets policies and apps at Microsoft Entra groups. An assigned group has members you add by hand. A dynamic group has a membership rule, and Entra adds or removes members automatically as their properties change. A dynamic group holds either users or devices, never both. Dynamic membership needs a Microsoft Entra ID P1 license, and updates aren't instant.

Writing device rules

Device rules start with device. and compare a property. Useful ones: deviceOSType, deviceOwnership (Company or Personal), deviceTrustType, enrollmentProfileName (Autopilot, Apple ADE or Android profile name) and devicePhysicalIds for Autopilot tags. Combine with -and / -or.

All company Windows devices:
(device.deviceOSType -eq "Windows") -and
(device.deviceOwnership -eq "Company")

All Autopilot devices:
(device.devicePhysicalIds -any
  (_ -startsWith "[ZTDId]"))

Autopilot group tag WH:
(device.devicePhysicalIds -any
  (_ -eq "[OrderID]:WH"))

Exam tip The Autopilot group tag shows up in Entra as [OrderID]. Match it exactly, or the group stays empty.

Planning Kibble's groups

Plan groups around how you'll target. Device groups suit settings that should follow the hardware: kiosks, scanners, Wi-Fi. User groups suit things that follow the person, like email apps. Name groups so anyone can read them, and keep one purpose per group.

• KC-Dev-Windows-All: dynamic, all company Windows PCs
• KC-Dev-Autopilot-WH: dynamic, group tag WH (warehouse)
• KC-Usr-Store-Staff: assigned, store employees
• KC-Dev-Pilot: assigned, ten test devices for new policies

Exam tip Dynamic groups take time to update. When a new device must get policy during setup, Autopilot device preparation uses an assigned group instead (month two).