Microsoft Entra hybrid join
Microsoft Entra hybrid join is a device identity configuration in which a device is joined to an on-premises Active Directory domain and registered with Microsoft Entra ID. It connects an existing domain-joined device to cloud identity capabilities.
An Active Directory device with a cloud identity
A hybrid joined Windows device keeps its on-premises Active Directory domain membership and is registered with Entra ID. Organizations use this arrangement when they still need Group Policy or applications that depend on Active Directory machine authentication, while also using cloud identity services.
That is different from Entra join, where the device joins the cloud directory without an on-premises domain join. Merely using Microsoft 365 on a domain-joined laptop does not establish hybrid join.
The on-premises dependency remains
Microsoft requires periodic connectivity to domain controllers for hybrid joined devices. That matters for laptops that spend long periods away from the corporate network. Hybrid join does not remove the domain relationship or its connectivity needs.
It also is not a compliance verdict. A device can have the expected directory relationships and still fail a required security setting. When investigating access, establish the join state and device identity first, then check compliance and the access policy separately. Avoid inferring an earlier state solely from today’s inventory record.