> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Modalities

> Active Directory (AD) Joined, Hybrid Joined (AD + Cloud), and Entra ID Joined (Cloud) Devices represent different approaches to managing authentication and access in an organization, each leveraging specific authentication protocols to meet unique business needs. TruU integrates seamlessly with your existing identity architecture, whether your organization uses AD, Hybrid, or Entra ID. It enhances security by enabling passwordless authentication, leveraging protocols like FIDO2 or extending your current authentication stack to provide a unified and secure user experience across all environments.

## Device Join Modalities

The following table outlines how devices behave in each join type — including how they authenticate, how they are managed, and their access to cloud and on-premises resources.

| **Feature**               | **Active Directory joined**                                                                                                                                 | **Microsoft Entra hybrid joined**                                                                                                                                                         | **Microsoft Entra joined**                                                                                                                                 |
| :------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **What it means**         | <ul><li>Device is joined to on-premises Active Directory.</li><li>Sign-in requires an Active Directory account.</li></ul>                                   | <ul><li>Device is joined to on-premises Active Directory.</li><li>Device identity is registered/synced to Microsoft Entra ID.</li><li>Sign-in uses an Active Directory account.</li></ul> | <ul><li>Device is joined to Microsoft Entra ID (cloud).</li><li>Sign-in uses a Microsoft Entra account (or a synced account if applicable).</li></ul>      |
| **Authentication**        | <ul><li>Password: Active Directory username and password.</li><li>TruU Desktop Authenticator: certificate-based authentication.</li></ul>                   | <ul><li>Password: Active Directory username and password.</li><li>TruU Desktop Authenticator: FIDO2 authenticator (recommended) or certificate-based authentication.</li></ul>            | <ul><li>Password: synced account username and password (if used).</li><li>TruU Desktop Authenticator: FIDO2 authenticator.</li></ul>                       |
| **Management**            | <ul><li>Managed via Group Policy Objects (GPOs) from on-premises Active Directory.</li></ul>                                                                | <ul><li>Managed via Group Policy and/or Intune policies.</li></ul>                                                                                                                        | <ul><li>Managed through Intune (or another MDM solution) with cloud policy enforcement.</li></ul>                                                          |
| **On-premises resources** | <ul><li>**Full, native access** to internal resources (file shares, printers, intranet apps).</li></ul>                                                     | <ul><li>**Full access** to on-premises resources (Kerberos) because the device maintains an AD trust.</li></ul>                                                                           | <ul><li>**Limited/no native access**; typically requires VPN/proxy and Kerberos key trust or connectors (as configured).</li></ul>                         |
| **Cloud resources**       | <ul><li>No Primary Refresh Token (PRT) from Microsoft Entra ID.</li><li>Seamless sign-in to Microsoft Entra-protected resources is not available.</li></ul> | <ul><li>**Full access** to Microsoft Entra-protected cloud resources (Microsoft 365, Teams, OneDrive).</li><li>PRT is issued at sign-in.</li></ul>                                        | <ul><li>**Full, direct access** to Microsoft Entra-protected cloud resources (Microsoft 365, Teams, OneDrive).</li><li>PRT is issued at sign-in.</li></ul> |
| **Internet dependency**   | <ul><li>**No dependency** for authentication on the corporate network.</li></ul>                                                                            | <ul><li>**Moderate** dependency for syncing with Microsoft Entra ID and receiving MDM policy updates.</li></ul>                                                                           | <ul><li>**High** dependency for authentication and device compliance checks.</li></ul>                                                                     |
| **Ideal for**             | <ul><li>On-premises organizations with minimal cloud integration.</li><li>Environments requiring strict internal control.</li></ul>                         | <ul><li>Hybrid environments.</li></ul>                                                                                                                                                    | <ul><li>Cloud-first or fully remote organizations using Microsoft Entra ID.</li></ul>                                                                      |

## TruU Authentication Modalities

TruU supports two primary authentication modalities that can be applied across all device join types — FIDO2 (Virtual FIDO Key) and Smartcard / Certificate-Based Authentication (Virtual Smartcard). Each serves a distinct purpose, depending on your organization’s identity architecture and compliance standards.

|                                 | **TruU FIDO2 Authenticator (virtual FIDO key)**                                                                                                                                                                                                                                                                                                                                                 | **TruU Smartcard CBA (virtual smartcard)**                                                                                                                                                                                                                                                                                            |
| :------------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Purpose**                     | <ul><li>Passwordless, phishing-resistant user sign-in.</li><li>Strong cryptographic validation without passwords.</li></ul>                                                                                                                                                                                                                                                                     | <ul><li>Certificate-based authentication using smartcard credentials.</li><li>Common fit for PKI / smartcard environments.</li></ul>                                                                                                                                                                                                  |
| **Technology**                  | <ul><li>FIDO2 / WebAuthn + CTAP.</li><li>Public/private key pairs protected by device security (e.g., TPM).</li></ul>                                                                                                                                                                                                                                                                           | <ul><li>X.509 certificates (PKI).</li><li>Keys/certs stored on smartcard/virtual smartcard (TPM-backed).</li></ul>                                                                                                                                                                                                                    |
| **Standards**                   | <ul><li>Open FIDO Alliance standard.</li><li>Broad OS and browser support.</li></ul>                                                                                                                                                                                                                                                                                                            | <ul><li>PKI-based authentication model.</li></ul>                                                                                                                                                                                                                                                                                     |
| **Authentication**              | <ul><li>User validates via TruU FIDO2 Authenticator using biometrics or PIN.</li><li>FIDO2 assertion is used for sign-in where configured.</li></ul>                                                                                                                                                                                                                                            | <ul><li>User authenticates with a smartcard certificate.</li><li>Fits Windows smartcard logon / certificate flows.</li></ul>                                                                                                                                                                                                          |
| **Device join type**            | <ul><li>**Supported:** Microsoft Entra hybrid joined and Microsoft Entra joined devices.</li><li>**Not intended:** Active Directory joined only (AD-only) devices.</li></ul>                                                                                                                                                                                                                    | <ul><li>**Recommended:** Active Directory joined (AD-only) devices for smartcard/CBA logon needs.</li><li>**Supported (with prerequisites):** Microsoft Entra hybrid joined (see prerequisites/notes).</li></ul>                                                                                                                      |
| **On-premises resource access** | <ul><li>Hybrid joined: Access via AD trust/Kerberos as normal.</li><li>Entra joined: on-prem access requires Kerberos key trust to obtain Kerberos tickets for AD resources.</li></ul>                                                                                                                                                                                                          | <ul><li>AD joined: native access to on-prem resources.</li><li>Hybrid joined: can access on-prem resources.</li></ul>                                                                                                                                                                                                                 |
| **Revocation**                  | <ul><li>No certificate revocation (CRL/OCSP) lifecycle.</li><li>Remove/disable the registered authenticator to block usage.</li></ul>                                                                                                                                                                                                                                                           | <ul><li>Certificate revocation via CRLs/OCSP per PKI policy.</li></ul>                                                                                                                                                                                                                                                                |
| **Deployment / operations**     | <ul><li>Typically, simpler at scale.</li><li>Managed through endpoint and identity policy (e.g., Intune + Entra policies).</li></ul>                                                                                                                                                                                                                                                            | <ul><li>Requires PKI: certificate issuance, renewal, and lifecycle management.</li></ul>                                                                                                                                                                                                                                              |
| **rerequisites / notes**        | <ul><li>**Enable** TruU FIDO2 Keys in Entra ID.</li><li>**Hybrid Entra Joined:** Configuring **Cloud Kerberos Trust** with Microsoft Entra ID is required to user TruU FIDO2 authenticator with Hybrid Entra Joined devices.</li><li>**Entra joined:** Optional - To access on-prem resources, you need **Cloud Kerberos Trust** (plus network path such as VPN/proxy as applicable).</li></ul> | <ul><li>**AD joined:** smartcard/CBA is the recommended option when certificate-based logon is required.</li><li>**Hybrid joined:** to use CBA and still get a **PRT** for seamless SSO to Microsoft 365/Office apps, enable **Microsoft Entra ID CBA** (per Entra policy) for Entra ID apps apps can obtain PRT-based SSO.</li></ul> |

<Frame>
  <img src="https://mintcdn.com/truu-2/v1MGUBFxoFscd5Tm/images/image-69.png?fit=max&auto=format&n=v1MGUBFxoFscd5Tm&q=85&s=2525d47ad5c8c090204aac74ec95f631" alt="Image" width="468" height="87" data-path="images/image-69.png" />
</Frame>

TruU’s support for both FIDO2 and Smartcard-based authentication ensures compatibility with diverse enterprise environments. Organizations can adopt passwordless authentication at their own pace, aligning with existing infrastructure and compliance goals.

***

[WA Configuration Options](/docs/wa-configuration-options)

[AD (Domain Joined) - CBA](/docs/wa-hybrid-azure-ad-domain-joined)