/
faq.yml
254 lines (187 loc) · 25.7 KB
/
faq.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
### YamlMime:FAQ
metadata:
title: Microsoft Entra device management FAQ
description: Microsoft Entra device management FAQ.
ms.service: entra-id
ms.subservice: devices
ms.custom: has-azure-ad-ps-ref
ms.topic: faq
ms.date: 03/01/2024
ms.author: joflore
author: MicrosoftGuyJFlo
manager: amycolannino
ms.reviewer: sandeo
title: Microsoft Entra device management FAQ
summary: |
sections:
- name: General FAQ
questions:
- question: I registered the device recently. Why can't I see the device under my user info? Or why is the device owner marked as N/A for Microsoft Entra hybrid joined devices?
answer: |
Windows 10 or newer devices that are Microsoft Entra hybrid joined don't show up under **USER devices**.
Use the **All devices** view. You can also use a PowerShell [Get-MgDevice](/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdevice) cmdlet.
Only the following devices are listed under **USER devices**:
- All personal devices that aren't Microsoft Entra hybrid joined.
- All non-Windows 10 or newer and Windows Server 2016 or later devices.
- All non-Windows devices.
- question: How do I know what the device registration state of the client is?
answer: |
Go to **All devices**. Search for the device by using the device ID. Check the value under the join type column. Sometimes, the device might be reset or reimaged. So it's essential to also check the device registration state on the device:
- For Windows 10 or newer and Windows Server 2016 or later devices, run `dsregcmd.exe /status`.
- For down-level OS versions, run `%programFiles%\Microsoft Workplace Join\autoworkplace.exe`.
For troubleshooting information, see these articles:
- [Troubleshooting devices using dsregcmd command](troubleshoot-device-dsregcmd.md)
- [Troubleshooting Microsoft Entra hybrid joined Windows 10 and Windows Server 2016 devices](troubleshoot-hybrid-join-windows-current.md)
- [Troubleshooting Microsoft Entra hybrid joined down-level devices](troubleshoot-hybrid-join-windows-legacy.md)
- question: My org on-premises AD users are split into two or more different tenants in Microsoft Entra ID. Do I get Windows PRT for each tenant on client machine?
answer: |
Windows clients fetch the PRT from Microsoft Entra ID if the user and the device belong to the same tenant. Users won't get a PRT for another tenant if the device isn't registered or the user isn't a member there. If the two tenants trust each other via B2B, you can always create cross tenant B2B access and trust device claims from your home tenant.
- question: I see the device record under the USER info and I see the state as registered. Am I set up correctly to use Conditional Access?
answer: |
The device join state, shown by **deviceID**, must match the state on Microsoft Entra ID and meet any evaluation criteria for Conditional Access.
For more information, see [Require managed devices for cloud app access with Conditional Access](~/identity/conditional-access/concept-conditional-access-grant.md).
- question: Why do my users see an error message saying "Your organization has deleted the device" or "Your organization has disabled the device" on their Windows 10/11 devices?
answer: |
On Windows 10/11 devices joined or registered with Microsoft Entra ID, users are issued a [Primary refresh token (PRT)](concept-primary-refresh-token.md) which enables single sign-on. The validity of the PRT is based on the validity of the device itself. Users see this message if the device is either deleted or disabled in Microsoft Entra ID without initiating the action from the device itself. A device can be deleted or disabled in Microsoft Entra one of the following scenarios:
- User disables the device from the My Apps portal.
- An administrator (or user) deletes or disables the device.
- Microsoft Entra hybrid joined only: An administrator removes the devices OU out of sync scope resulting in the devices being deleted from Microsoft Entra ID.
- Microsoft Entra hybrid joined only: An administrator disables the computer account on premises, resulting in the device being disabled in Microsoft Entra ID.
- Upgrading Microsoft Entra Connect to the version 1.4.xx.x. [Understanding Microsoft Entra Connect 1.4.xx.x and device disappearance](/troubleshoot/azure/active-directory/reference-connect-device-disappearance).
- question: I disabled or deleted my device, but the local state on the device says it's still registered. What should I do?
answer: |
This operation is by design. In this case, the device doesn't have access to resources in the cloud. Administrators can perform this action for stale, lost, or stolen devices to prevent unauthorized access. If this action was performed unintentionally, you need to re-enable or re-register the device using the steps that follow:
- If the device was disabled in Microsoft Entra ID, an administrator with sufficient privileges can enable it in the Microsoft Entra admin center.
> [!NOTE]
> If you're syncing devices using Microsoft Entra Connect, Microsoft Entra hybrid joined devices will be automatically re-enabled during the next sync cycle. So, if you need to disable a Microsoft Entra hybrid joined device, you need to disable it from your on-premises AD.
- If the device is deleted in Microsoft Entra ID, you need to re-register the device. To re-register, you must take a manual action on the device. See the following steps for instructions to re-register based on the device state.
To re-register Microsoft Entra hybrid joined Windows 10/11 and Windows Server 2016/2019 devices, take the following steps:
1. Open the command prompt as an administrator.
1. Enter `dsregcmd.exe /debug /leave`.
1. Sign out and sign in to trigger the scheduled task that registers the device again with Microsoft Entra ID.
For down-level Windows OS versions that are Microsoft Entra hybrid joined, take the following steps:
1. Open the command prompt as an administrator.
1. Enter `"%programFiles%\Microsoft Workplace Join\autoworkplace.exe /l"`.
1. Enter `"%programFiles%\Microsoft Workplace Join\autoworkplace.exe /j"`.
For Microsoft Entra joined devices Windows 10/11 devices, take the following steps:
1. Open the command prompt as an administrator
1. Enter `dsregcmd /forcerecovery` (You need to be an administrator to perform this action).
1. Click "Sign in" in the dialog that opens up and continue with the sign in process.
1. Sign out and sign back in on the device to complete the recovery.
For Microsoft Entra registered Windows 10/11 devices, take the following steps:
1. Go to **Settings** > **Accounts** > **Access Work or School**.
1. Select the account and select **Disconnect**.
1. Click on "+ Connect" and register the device again by going through the sign in process.
- question: Why do I see duplicate device entries?
answer: |
- For Windows 10 or newer and Windows Server 2016 or later, repeated tries to unjoin and rejoin the same device might cause duplicate entries.
- Each Windows user who uses **Add Work or School Account** creates a new device record with the same device name.
- For down-level Windows OS versions that are on-premises Azure Directory domain joined, automatic registration creates a new device record with the same device name for each domain user who signs in to the device.
- A Microsoft Entra joined machine that's wiped, reinstalled, and rejoined with the same name shows up as another record with the same device name.
- question: Does Windows 10/11 device registration in Microsoft Entra support TPMs in FIPS mode?
answer: Windows 10/11 device registration is only supported for FIPS-compliant TPM 2.0 and not supported for TPM 1.2. If your devices have FIPS-compliant TPM 1.2, you must disable them before proceeding with Microsoft Entra join or Microsoft Entra hybrid join. Microsoft doesn't provide any tools for disabling FIPS mode for TPMs as it is dependent on the TPM manufacturer. Contact your hardware OEM for support.
- question: Why can a user still access resources from a device I disabled?
answer: |
It takes up to an hour for a revoke to be applied from the time the Microsoft Entra device is marked as disabled.
>[!NOTE]
>For enrolled devices, we recommend that you wipe the device to make sure users can't access the resources. For more information, see [What is device enrollment?](/mem/intune/user-help/use-managed-devices-to-get-work-done).
- question: I can't add more than 3 Microsoft Entra user accounts under the same user session on a Windows 10/11 device, why?
answer: |
Microsoft Entra ID added support for multiple Microsoft Entra accounts starting in Windows 10 1803 release. However, Windows 10/11 restricts the number of Microsoft Entra accounts on a device to 3 to limit the size of token requests and enable reliable single sign-on (SSO). Once 3 accounts are added, users see an error for subsequent accounts. The additional problem information on the error screen provides the following message indicating the reason - "Add account operation is blocked because account limit is reached".
- question: What are the MS-Organization-Access certificates present on our Windows 10/11 devices?
answer: |
The MS-Organization-Access certificates are issued by the Microsoft Entra Device Registration Service during the device registration process. These certificates are issued to all join types supported on Windows - Microsoft Entra joined, Microsoft Entra hybrid joined and Microsoft Entra registered devices. Once issued, they're used as part of the authentication process from the device to request a Primary Refresh Token (PRT). For Microsoft Entra joined and Microsoft Entra hybrid joined devices, this certificate is present in Local Computer\Personal\Certificates whereas for Microsoft Entra registered devices, certificate is present in Current User\Personal\Certificates. All MS-Organization-Access certificates have a default lifetime of 10 years. These certificates are deleted from the corresponding certificate store when the device is unregistered from Microsoft Entra ID. Any inadvertent deletion of this certificate leads to authentication failures for the user, and requiring re-registration of the device in such cases.
- name: Microsoft Entra join FAQ
questions:
- question: How do I unjoin a Microsoft Entra joined device locally on the device?
answer: |
For pure Microsoft Entra joined devices, make sure you have an offline local administrator account or create one. You can't sign in with any Microsoft Entra user credentials. Next, go to **Settings** > **Accounts** > **Access Work or School**. Select your account and select **Disconnect**. Follow the prompts and provide the local administrator credentials when prompted. Reboot the device to finish the unjoin process.
- question: Can my users sign in to Microsoft Entra joined devices that are deleted or disabled in Microsoft Entra ID?
answer: |
Yes. Windows has a cached username and password capability that allows users who signed in previously to access the desktop quickly even without network connectivity.
When a device is deleted or disabled in Microsoft Entra ID, it's not known to the Windows device. So users who signed in previously continue to access the desktop with the cached username and password. But as the device is deleted or disabled, users can't access any resources protected by device-based Conditional Access.
Users who didn't sign in previously can't access the device. There's no cached username and password enabled for them.
- question: Can a disabled or deleted user sign in to a Microsoft Entra joined device?
answer: |
Yes, but only for a limited time. When a user is deleted or disabled in Microsoft Entra ID, it's not immediately known to the Windows device. So users who signed in previously can access the desktop with the cached username and password.
Typically, the device is aware of the user state in less than four hours. Then Windows blocks those users' access to the desktop. As the user is deleted or disabled in Microsoft Entra ID, all their tokens are revoked. So they can't access any resources.
Deleted or disabled users who didn't sign in previously can't access a device. There's no cached username and password enabled for them.
- question: Can a guest user sign in to a Microsoft Entra joined device?
answer: |
No, currently, guest users can't sign in to a Microsoft Entra joined device.
- question: My users can't search printers from Microsoft Entra joined devices. How can I enable printing from those devices?
answer: |
Organizations can choose to [deploy Windows Server Hybrid Cloud Print with Pre-Authentication](/universal-print/) or [Universal Print](/universal-print/fundamentals/universal-print-whatis) for their Microsoft Entra joined devices.
- question: How do I connect to a remote Microsoft Entra joined device?
answer: |
See [Connect to remote Microsoft Entra joined PC](/windows/client-management/client-tools/connect-to-remote-aadj-pc).
- question: Why do my users see 'You can't get there from here'?
answer: |
Did you configure certain Conditional Access rules to require a specific device state? If the device doesn't meet the criteria, users are blocked, and they see that message.
Evaluate the Conditional Access policy rules. Make sure the device meets the criteria to avoid the message.
- question: Why do I get a 'username or password is incorrect' message for a device I just joined to Microsoft Entra ID?
answer: |
Common reasons for this scenario are as follows:
- Your user credentials are no longer valid.
- Your computer can't communicate with Microsoft Entra ID. Check for any network connectivity issues.
- Federated sign-ins require your federation server to support WS-Trust endpoints that are enabled and accessible.
- You enabled pass-through authentication. So your temporary password needs to be changed when you sign in.
- question: How can users change their temporary or expired password on Microsoft Entra joined devices?
answer: |
Currently, Microsoft Entra joined devices don't force users to change password on the lock screen. So, users with temporary or expired passwords will be forced to change passwords only when they access an application (that requires a Microsoft Entra token) after they log in to Windows.
- question: Why do I see the 'Oops… an error occurred!' dialog when I try to Microsoft Entra join my PC?
answer: |
This error happens when you set up Microsoft Entra autoenrollment with Intune without proper license assigned. Make sure that the user who tries to Microsoft Entra join has the correct Intune license assigned. For more information, see [Set up enrollment for Windows devices](/mem/intune/enrollment/windows-enroll).
- question: Why did my attempt to Microsoft Entra join a PC fail, although I didn't get any error information?
answer: |
A likely cause is that you signed in to the device by using the local built-in administrator account.
Create a different local account before you use Microsoft Entra join to finish the setup.
- question: What is the P2P Server application and why is it registered in my tenant?
answer: |
The P2P Server application is application registered by Microsoft Entra ID to enable Remote Desktop Protocol (RDP) connections to any Microsoft Entra joined or Microsoft Entra hybrid joined Windows devices in your tenant. This application creates a tenant wide certificate issued by Microsoft Entra's certificate authority and is used to issue RDP device and user certificates for RDP connectivity. To ensure this is the correct application, you can find the **Object ID** of the P2P Server application in the **Microsoft Entra admin center** > **Applications** > **Enterprise Applications**. Remove the default filter applied do you can see all applications. Compare this **Object ID** using the Microsoft Graph API to query for the details using [GET /servicePrincipals/{objectid}](/graph/api/serviceprincipal-get) and confirm that the servicePrincipalNames property is `urn:p2p_cert`.
- question: What are the MS-Organization-P2P-Access certificates present on our Windows 10/11 devices?
answer: |
The MS-Organization-P2P-Access certificates are issued by Microsoft Entra ID to both, Microsoft Entra joined and Microsoft Entra hybrid joined devices. These certificates are used to enable trust between devices in the same tenant for remote desktop scenarios. One certificate is issued to the device and another is issued to the user. The device certificate is present in `Local Computer\Personal\Certificates` and is valid for one day. This certificate is renewed (by issuing a new certificate) if the device is still active in Microsoft Entra ID. The user certificate isn't persistent and is valid for one hour, but it's issued on-demand when a user attempts a remote desktop session to another Microsoft Entra joined device. It isn't renewed on expiry. Both these certificates are issued using the MS-Organization-P2P-Access certificate present in the `Local Computer\AAD Token Issuer\Certificates`. This certificate is issued by Microsoft Entra ID during device registration.
- question: How can we disable cached logon/expire the cache logon of the user on Microsoft Entra joined devices?
answer: |
It isn't possible to disable or expire previous cached logons on Microsoft Entra joined devices.
- name: Microsoft Entra hybrid join FAQ
questions:
- question: How do I unjoin a Microsoft Entra hybrid joined device locally on the device?
answer: For Microsoft Entra hybrid joined devices, make sure to turn off automatic registration in AD using the [Controlled validation](hybrid-join-control.md) article. Then the scheduled task won't register the device again. Next, open a command prompt as an administrator and enter `dsregcmd.exe /debug /leave`. Or run this command as a script across several devices to unjoin in bulk.
- question: Where can I find troubleshooting information to diagnose Microsoft Entra hybrid join failures?
answer: |
For troubleshooting information, see these articles:
- [Troubleshooting Microsoft Entra hybrid joined Windows 10 and Windows Server 2016 devices](troubleshoot-hybrid-join-windows-current.md)
- [Troubleshooting Microsoft Entra hybrid joined down-level devices](troubleshoot-hybrid-join-windows-legacy.md)
- question: Why do I see a duplicate Microsoft Entra registered record for my Windows 10/11 Microsoft Entra hybrid joined device in the Microsoft Entra devices list?
answer: |
When your users add their accounts to apps on a domain-joined device, they might be prompted with **Add account to Windows?** If they enter **Yes** on the prompt, the device registers with Microsoft Entra ID. The trust type is marked as Microsoft Entra registered. After you enable Microsoft Entra hybrid join in your organization, the device also gets Microsoft Entra hybrid joined. Then two device states show up for the same device.
In most cases, Microsoft Entra hybrid join takes precedence over the Microsoft Entra registered state, resulting in your device being considered Microsoft Entra hybrid joined for any authentication and Conditional Access evaluation. However, sometimes, this dual state can result in a nondeterministic evaluation of the device and cause access issues. We strongly recommend upgrading to Windows 10 version 1803 and above where we automatically clean up the Microsoft Entra registered state. Learn how to [avoid or clean up this dual state on the Windows 10 machine](hybrid-join-plan.md#review-things-you-should-know).
- question: Why do my users have issues on Windows 10 Microsoft Entra hybrid joined devices after changing their UPN?
answer: |
UPN changes are supported with Windows 10 2004 update and also applicable to Windows 11. Users on devices with this update won't have any issues after changing their UPNs.
UPN changes on older versions of Windows 10 aren't fully supported with Microsoft Entra hybrid joined devices. While users can sign in to the device and access their on-premises applications, authentication with Microsoft Entra ID fails after a UPN change. As a result, users have SSO and Conditional Access issues on their devices. You need to unjoin the device from Microsoft Entra ID (run "dsregcmd /leave" with elevated privileges) and rejoin (happens automatically) to resolve the issue.
- question: Do Windows 10/11 Microsoft Entra hybrid joined devices require line of sight to the domain controller to get access to cloud resources?
answer: |
No, except when the user's password is changed. After Windows 10/11 Microsoft Entra hybrid join is complete, and the user has signed in at least once, the device doesn't require line of sight to the domain controller to access cloud resources. Windows 10/11 can get single sign-on to Microsoft Entra applications from anywhere with an internet connection, except when a password is changed. Users who sign in with Windows Hello for Business continue to get single sign-on to Microsoft Entra applications even after a password change, even if they don't have line of sight to their domain controller.
- question: What happens if a user changes their password and tries to sign in to their Windows 10/11 Microsoft Entra hybrid joined device outside the corporate network?
answer: |
If a password is changed outside the corporate network (for example, by using Microsoft Entra SSPR), then the user sign-in with the new password fails. For Microsoft Entra hybrid joined devices, on-premises Active Directory is the primary authority. When a device doesn't have line of sight to a domain controller, it's unable to validate the new password. The user needs to establish a connection with the domain controller (either via VPN or being in the corporate network) before they're able to sign in to the device with their new password. Otherwise, they can only sign in with their old password because of cached sign-in capability in Windows. However, the old password is invalidated by Microsoft Entra ID during token requests and hence, prevents single sign-on and fails any device-based Conditional Access policies until the user authenticates with their new password in an app or browser. This issue doesn't occur if you use Microsoft Entra joined devices.
- name: Microsoft Entra register FAQ
questions:
- question: How do I remove a Microsoft Entra registered state for a device locally?
answer: |
- For Windows 10/11 Microsoft Entra registered devices, Go to **Settings** > **Accounts** > **Access Work or School**. Select your account and select **Disconnect**. Device registration is per user profile on Windows 10/11.
- For iOS and Android, you can use the Microsoft Authenticator application **Settings** > **Device Registration** and select **Unregister device**.
- For macOS, you can use the Microsoft Intune Company Portal application to unenroll the device from management and remove any registration.
For Windows 10 version 2004 and older, this process can be automated with the [Workplace Join (WPJ) removal tool](https://download.microsoft.com/download/8/e/f/8ef13ae0-6aa8-48a2-8697-5b1711134730/WPJCleanUp.zip).
> [!NOTE]
> This tool removes all SSO accounts on the device. After this operation, all applications will lose SSO state, and the device will be unenrolled from management tools (MDM) and unregistered from the cloud. The next time an application tries to sign in, users will be asked to add the account again.
- question: How can I block users from adding more work accounts (Microsoft Entra registered) on my corporate Windows 10/11 devices?
answer: |
Enable the following registry to block your users from adding other work accounts to your corporate domain joined, Microsoft Entra joined, or Microsoft Entra hybrid joined Windows 10/11 devices. This policy can also be used to block domain joined machines from inadvertently getting Microsoft Entra registered with the same user account.
`HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin, "BlockAADWorkplaceJoin"=dword:00000001`
additionalContent: |
## Related content
- [The Microsoft Error Lookup Tool](/windows/win32/debug/system-error-code-lookup-tool)