Device Registration & Licensing

Device identity — why devices need accounts too

The three device join types

Feature	Entra Registered	Entra Joined	Hybrid Entra Joined
Ownership	Personal (BYOD)	Organisation-owned	Organisation-owned
OS support	Windows 10/11, iOS, Android, macOS, Linux	Windows 10/11, macOS 13+, Ubuntu 22.04/24.04, RHEL 8/9	Windows 10/11
On-prem AD required
Sign-in method	Local/personal account	Entra ID credentials	Domain credentials + Entra sync
Device management	Optional (MAM via Intune)	Full MDM (Intune)	Group Policy + Intune co-management
SSO to cloud resources	Yes (after auth)	Yes (primary refresh token)	Yes (primary refresh token)
CA support	Limited	Full (compliance, device type)	Full (compliance, device type)
Best for	Personal phones and tablets	Cloud-first organisations	Hybrid environments migrating to cloud

How each join type works

Entra registered (BYOD):

1. User goes to Settings → Accounts → Access work or school
2. Adds their work account
3. Device gets registered in Entra ID — user keeps personal device control
4. Organisation can apply app-level policies (MAM) but not full device management

Entra joined (cloud-managed):

1. During Windows OOBE (first setup) or Settings → join this device to Entra ID
2. User signs in with Entra credentials
3. Device is fully managed — organisation controls it via Intune
4. User gets SSO to all cloud apps via Primary Refresh Token (PRT)

Hybrid Entra joined:

1. Device is joined to on-premises Active Directory (as usual)
2. Entra Connect syncs the device object to Entra ID
3. Device has both an AD computer account AND an Entra device object
4. Enables cloud features (CA, Intune co-management) for legacy domain-joined devices

ℹ️ Scenario: Jake vs Priya — different device strategies

Jake at Coastline Creative (35 people, no on-prem AD): All devices are Entra joined. Laptops are company-owned, fully managed by Intune. Freelancers use personal devices that are Entra registered — they get email access via Outlook mobile with app protection policies.

Priya at Meridian Health (5,000 employees, hybrid AD): Workstations in hospitals are Hybrid Entra joined — they’re domain-joined for Group Policy but also synced to Entra for Conditional Access. Over time, new devices are being deployed as Entra joined only, skipping the on-prem AD step entirely. This is the cloud migration path.

💡 Exam tip: device join decision logic

The exam often gives a scenario and asks which join type to use. Use this decision logic:

• Personal device (BYOD)? → Entra Registered (always)
• Corporate device, no on-prem AD? → Entra Joined
• Corporate device, existing on-prem AD? → Hybrid Entra Joined (migration) or Entra Joined (greenfield)
• Need full MDM management? → Entra Joined or Hybrid Entra Joined (Registered = MAM only)
• Conditional Access needs compliant device? → Must be Joined or Hybrid Joined (Registered has limited CA support)
• Question mentions “shared device” or “kiosk”? → Entra Joined with shared device mode

Device settings in the Entra admin center

Setting	What It Controls
Users may join devices to Entra ID	All, Selected users/groups, or None
Users may register their devices	All, Selected users/groups, or None
Maximum number of devices per user	Default: 50 (reduce for tighter control)
Require MFA to register or join devices	Additional auth step for device registration
Additional local administrators on Entra joined devices	Add specific users/groups as local admins

Licensing — assign, modify, report

Direct vs group-based licensing

Method	How It Works	Best For
Direct assignment	Manually assign licence to individual user	One-off assignments, exceptions
Group-based licensing	Assign licence to a group — all members get it automatically	Scalable, automated management

Group-based licensing is the recommended approach:

1. Create a security group (e.g., “M365 E5 Users”)
2. Assign the M365 E5 licence to the group
3. Add users to the group → they automatically receive the licence
4. Remove users from the group → licence is automatically reclaimed

💡 Exam tip: licence conflicts and errors

Group-based licensing can hit errors:

• Not enough licences — more group members than available licences. New members enter an error state.
• Conflicting service plans — a user is in two groups that assign licences with overlapping service plans that can’t coexist.
• Missing usage location — users without a usage location can’t receive licences.
• Missing dependencies — some service plans require other plans to be enabled first.

Check for errors: Entra admin center → Licences → select a product → check for users in error state. The exam tests your ability to identify and resolve these conflicts.

Reporting on licences

Where to check licence usage:

• Entra admin center → Licences → All products — see total/assigned/available per SKU
• Microsoft 365 admin center → Billing → Licences — similar view with purchase details
• Microsoft Graph API / PowerShell — programmatic access for reports and automation

# Report on licence assignments using Microsoft Graph PowerShell
Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits,
  @{Name="Available"; Expression={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}

ℹ️ Scenario: Jake optimises licensing at Coastline Creative

Jake discovers that 5 freelancers who left still have M365 Business Premium licences assigned. At $22/user/month, that’s $110/month wasted.

He runs a PowerShell script to find users with licences but no sign-in activity in 90 days, removes the licences, and sets up a dynamic group so licences are automatically assigned based on employment status.

Lesson: Regular licence reporting saves money. Group-based licensing with dynamic groups prevents orphaned licences.

🎬 Video walkthrough

🎬 Video coming soon

Device Registration & Licensing — SC-300 Module 4

Device Registration & Licensing — SC-300 Module 4

~10 min

Flashcards

Question

What are the three device identity models in Entra ID?

Click or press Enter to reveal answer

Answer

1) Entra Registered — BYOD/personal devices (visitor badge). 2) Entra Joined — cloud-managed corporate devices (employee ID). 3) Hybrid Entra Joined — domain-joined + synced to Entra (both identities). Each provides increasing levels of management and trust.

Click to flip back

Question

What is a Primary Refresh Token (PRT)?

Click or press Enter to reveal answer

Answer

A token issued to Entra Joined and Hybrid Entra Joined devices that enables SSO across cloud applications. The user authenticates once at device sign-in, and the PRT handles subsequent app authentication silently.

Click to flip back

Question

What is group-based licensing?

Click or press Enter to reveal answer

Answer

Assign a licence to a security group — all members automatically receive it. When users join the group, they get the licence. When they leave, it's reclaimed. Recommended over direct assignment for scalable management.

Click to flip back

Question

Name three common group-based licensing errors.

Click or press Enter to reveal answer

Answer

1) Not enough licences — more members than available licences. 2) Conflicting service plans — overlapping plans from multiple groups. 3) Missing usage location — users need a country set before licence assignment.

Click to flip back

Knowledge Check

Knowledge Check

Coastline Creative is a cloud-only organisation. Jake wants company laptops to be fully managed by Intune with SSO to all cloud apps. Freelancers should use their own devices but with app protection policies on Outlook. Which device strategy is correct?

AEntra Joined for company laptops, Entra Registered for freelancer BYOD devicesBHybrid Entra Joined for company laptops, Entra Joined for freelancer devicesCEntra Registered for both — registration is sufficient for all scenariosDHybrid Entra Joined for both — it provides the most features

Check Answer

Knowledge Check

Priya assigns an M365 E5 licence to a security group. A new nurse is added to the group but doesn't receive the licence. What's the most likely cause?

AThe nurse doesn't have a usage location setBThe nurse's account is disabledCGroup-based licensing requires a P2 licenceDThe nurse needs to accept the licence in their email

Check Answer

Knowledge Check

A Meridian Health hospital workstation is joined to the on-premises Active Directory and also has an identity in Entra ID via Entra Connect. Which device identity model is this?

AEntra RegisteredBEntra JoinedCHybrid Entra JoinedDDomain Joined (no Entra identity)

Check Answer

---

Next up: External Identities: Guest Access & B2B — invite contractors, partners, and vendors to collaborate securely without creating internal accounts.