> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Device Join Types

> Reference guide for the three Microsoft device join types — Active Directory Joined, Entra Hybrid Joined, and Entra Joined — and how each affects authentication, management, and resource access.

Microsoft supports three ways to join a Windows device to an identity infrastructure. Understanding your join type is the first step in selecting the right TruU authentication modality.

For a quick summary of which TruU modality applies to each join type, see [TruU Windows Authenticator Modalities](/docs/truu-windows-authenticator-modalities).

For Microsoft's full documentation on device identity, see [What is a device identity?](https://learn.microsoft.com/en-us/entra/identity/devices/overview) on Microsoft Learn.

## Microsoft Device Join Types

The following table describes all three join types — what each means, how devices authenticate, how they are managed, and their access to on-premises and cloud resources.

| Feature                   | Active Directory Joined                                                                                             | Microsoft Entra Hybrid Joined                                                                                                                           | Microsoft Entra Joined                                                                                                           |
| :------------------------ | :------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------- |
| **What it means**         | Device is joined to on-premises Active Directory. Sign-in requires an Active Directory account.                     | Device is joined to on-premises Active Directory and its identity is registered/synced to Microsoft Entra ID. Sign-in uses an Active Directory account. | Device is joined to Microsoft Entra ID (cloud only). Sign-in uses a Microsoft Entra account (or a synced account if applicable). |
| **Authentication**        | Password: AD username and password. TruU: certificate-based authentication (CBA).                                   | Password: AD username and password. TruU: FIDO2 (recommended) or certificate-based authentication.                                                      | Password: synced account username and password (if used). TruU: FIDO2 authenticator.                                             |
| **Management**            | Managed via Group Policy Objects (GPOs) from on-premises Active Directory.                                          | Managed via Group Policy and/or Intune policies.                                                                                                        | Managed through Intune (or another MDM solution) with cloud-based policy enforcement.                                            |
| **On-premises resources** | Full, native access to internal resources (file shares, printers, intranet apps).                                   | Full access to on-premises resources via Kerberos — the device maintains an Active Directory trust.                                                     | Limited or no native access. Typically requires VPN or proxy, plus Kerberos Key Trust or a connector, as configured.             |
| **Cloud resources**       | No Primary Refresh Token (PRT) from Microsoft Entra ID. Seamless SSO to Entra-protected resources is not available. | Full access to Microsoft Entra-protected resources (Microsoft 365, Teams, OneDrive). PRT is issued at sign-in.                                          | Full, direct access to Microsoft Entra-protected resources (Microsoft 365, Teams, OneDrive). PRT is issued at sign-in.           |
| **Internet dependency**   | None for authentication on the corporate network.                                                                   | Moderate — required for syncing with Microsoft Entra ID and receiving MDM policy updates.                                                               | High — required for authentication and device compliance checks.                                                                 |
| **Ideal for**             | On-premises organizations with minimal cloud integration or strict internal control requirements.                   | Hybrid environments transitioning to the cloud while maintaining on-premises infrastructure.                                                            | Cloud-first or fully remote organizations using Microsoft Entra ID.                                                              |

<Info>
  To check your device's join type, run `dsregcmd /status` in PowerShell and inspect the **AzureAdJoined** and **DomainJoined** fields.
</Info>