Azure AD Join Guide

How to properly Azure AD Join a Windows device that is currently only Workplace Registered (Azure AD Registered).

Prerequisites

• The device must have internet access
• The user must have an Authentica Solutions email account
• Azure AD admin must allow users to join devices (Entra ID > Devices > Device settings)

Why This Matters

A device that is only “Workplace Registered” cannot:

• Receive Intune compliance policies
• Get a Primary Refresh Token (PRT) for SSO
• Be remotely managed via Intune
• Enforce conditional access policies

This was the root cause of Intune error 2016281112 and login hangs reported in Feb 2026.

Diagnostic: Check Current State

Before starting, verify the device’s current join status:

dsregcmd /status

Key fields to check:

Field	Expected (Registered Only)	Expected (Properly Joined)
AzureAdJoined	NO	YES
WorkplaceJoined	YES	NO
AzureAdPrt	NO	YES
WorkplaceMdmUrl	(empty)	(populated)

Procedure

Step 1 — Create a Local Admin Account (MUST DO FIRST)

You need this as a safety net. The Azure AD Join process requires disconnecting the existing registration, which may remove your ability to sign in. Do this while still logged in:

1. Open Settings > Accounts > Other users
2. Click Add someone else to this PC
3. Click I don’t have this person’s sign-in information
4. Click Add a user without a Microsoft account
5. Create a username (e.g. LocalAdmin) and a strong password
6. Once created, click on the new account > Change account type > set to Administrator
7. Test it — Sign out and sign in with the local admin account to confirm it works, then sign back in with your normal account

Step 2 — Back Up Files (MUST DO SECOND)

After Azure AD Join, a new Windows user profile is created. The old profile folder remains on disk but is not mapped to the new account. To be safe:

1. Copy Desktop, Documents, Downloads, and any other important files to a USB drive or OneDrive
2. Note any browser bookmarks or app settings you want to keep
3. If using OneDrive, make sure everything is fully synced before proceeding

Step 3 — Remove Existing Workplace Registration

1. Open Settings > Accounts > Access work or school
2. Select your Authentica Solutions account
3. Click Disconnect
4. Restart the laptop

Step 4 — Azure AD Join

1. Sign in with the LocalAdmin account
2. Open Settings > Accounts > Access work or school
3. Click Connect
4. Important: Do NOT type your email in the main box. Instead, click the link that says “Join this device to Azure Active Directory” (below the email field)
5. Enter your Authentica email address and click Next
6. Enter your password and click Sign in
7. Complete MFA if prompted
8. Review the organization info (should show “Authentica Solutions”) and click Join
9. Click Done
10. Restart the laptop

Step 5 — Verify and Restore

1. Log in with your Authentica account (it should now appear on the login screen)
2. Open a Command Prompt as Administrator
3. Run: dsregcmd /status
4. Confirm AzureAdJoined shows YES
5. Copy backed-up files into the new profile’s Desktop/Documents/Downloads folders

Common Issues

“Join this device to Azure Active Directory” link not visible: This can happen when Windows display scaling is increased. Try reducing the font/display size, or scroll down in the dialog.

MFA not prompting: Ensure the user’s MFA methods are configured in Entra ID before attempting the join.

Join fails with access denied: Check Entra ID > Devices > Device settings — “Users may join devices to Azure AD” must be set to “All” or include the user.