Microsoft Entra join
Microsoft Entra join establishes a device identity in Microsoft Entra ID and lets users sign in to the device with an organizational account. It is distinct from joining an on-premises Active Directory domain.
The directory used for device sign-in
On an Entra joined Windows laptop, the user signs in with an organizational account from Entra ID. The laptop is not joined to an on-premises Active Directory domain. It can still reach on-premises resources when the required connectivity and authentication are available.
This differs from Entra registration, which associates a device with the directory while allowing the user to keep their existing device sign-in. It also differs from hybrid join, where an Active Directory domain relationship remains in place.
What the join state leaves unanswered
Join establishes the device’s directory relationship. Management supplies settings and software; compliance assesses the device against assigned rules. Those are separate jobs, even when one enrollment process sets them up together.
If an application requires a compliant device, finding a joined-device record is not enough to explain an access decision. Match the device ID in the sign-in to its inventory record, then inspect compliance and the applied access policy. A join label alone cannot tell you whether encryption, updates, or other required settings were in place.