Entra ID Integration IV: Microsoft Entra Join

Microsoft Entra Join Overview

In comparison to Windows Autopilot, the Microsoft Entra join can be performed from the out-of-the-box experience and additionally from the Settings application for already used devices. Microsoft Entra join allows a very simple and convenient enrollment mechanism for devices and without any interaction of the IT department. As well as for Windows Autopilot, a Mobility (MDM and WIP) application is required in your Microsoft Entra ID with specific permissions and the URLs of your Silverback instance. 

Your users only need to connect to an internet connection, and they need to know their Microsoft Entra ID Credentials and can enroll the device within a few steps. After that, Silverback can apply all configurations and can transform the device into an enterprise ready and secured device and can install the UEM Agent to install Software Packages on top. Additionally, you can easily deploy the EgoSecure Data Protection agent for an additional security layer. 

Prerequisites

• Accomplished Microsoft Entra ID Integration Guide I & II
  • Microsoft Entra ID Integration I: Configure Microsoft Entra ID
  • Microsoft Entra ID Integration II: Configure Silverback
• Microsoft Entra ID Premium P1 or greater, or any bundle which includes this license.

Review registration settings

Before you start, you should review if your users are already able to Join devices to Microsoft Entra. To do that, perform the following steps: 

• Open Azure Portal and login as an Administrator
• Select Microsoft Entra ID
• Expand Manage and select Devices
• Expand Manage and select Device Settings
• Under Users may join devices to Microsoft Entra, select either All or Selected:
  • If All is selected, all users can join their devices to Microsoft Entra ID
  • If Select is selected, only users specified can join their devices to Microsoft Entra ID
  • To add users, select the link under No member selected, press +Add and select the desired users and/or groups to add
  • Once all of the desired users and groups are selected, press Select and confirm with OK
• Press Save

Enrollment Options

You can provision Microsoft Entra joined devices using the following approaches:

• Microsoft Entra ID Join via OOBE (Out of Box Experience):
  • Performed during the initial setup of a new device.
  • The user is guided to sign in with their Microsoft Entra ID credentials as part of the Windows setup process.
  • Automatically joins the device to the Microsoft Entra tenant and applies enrollment policies immediately.
  • Suitable for new devices or devices that have been reset.
• Microsoft Entra ID Join via System Settings:
  • Performed on an already configured device via Settings
  • Requires manual initiation by the user or IT.
  • Joins the device to Microsoft Entra ID without resetting existing configurations.
  • Ideal for adding existing corporate devices to Microsoft Entra ID.
• Microsoft Entra ID registered devices
  • The devices are registered in Microsoft Entra, but not fully joined or managed
  • From the device management perspective with Silverback, there is no difference to the Microsoft Entra ID Join
  • Performed on an already configured device via Settings
  • Users will still sign in with their personal accour or a local account on the device

All methods achieve the same end result—joining the device to Microsoft Entra ID—but differ in timing, user experience, and deployment scenarios. Please note that depending on your version of Windows 10/11 and your network setup, your individual experience  in the following step-by-step guide may vary.

Next Steps

• Review all Windows 10/11 Profiles and configurations: Tags Guide Part IV: Windows 10/11
• Try Microsoft Autopilot: Microsoft Entra ID Integration III: Windows 10 Autopilot
• Protect your mobile applications with the Microsoft Entra Integration VI: App Protection Policies