Most of the reasons for keeping Windows devices tied to Active Directory now have cloud-native answers. Before you settle on hybrid join for the long term, test whether your blockers are still real.
Topic Endpoint
The short version
For years, joining Windows devices to Active Directory was the standard approach. Applications, file shares, certificates and device policies all relied on it. That’s no longer the case.
Microsoft now recommends cloud-native Windows devices, joined to Microsoft Entra ID and managed with Intune, as its preferred model.
File shares, Group Policy, certificates and single sign-on all have practical cloud-native options.
Hybrid join is still supported, but it often brings the complexity of both worlds.
The question is no longer “can we move away from domain-joined devices?” It’s “do we still have a reason not to?”
Three ways to join a device
Active Directory join
Devices join an on-premises Active Directory domain and are managed mainly through Group Policy and traditional tools.
Hybrid join
Devices join both Active Directory and Microsoft Entra ID. Hybrid join was designed as a stepping stone, letting organisations adopt cloud services while keeping their on-premises dependencies.
Microsoft Entra join
Devices join Microsoft Entra ID directly and are managed with cloud services such as Microsoft Intune and Windows Autopilot. This cuts reliance on on-premises servers and unlocks modern security controls.
The biggest myth: “we need hybrid join”
We often hear “we’d love to modernise, but our environment isn’t ready.” The usual concerns are file shares, legacy apps, Group Policy, certificates and single sign-on. Those concerns were valid a few years ago. Most now have practical answers.
File shares are no longer a major barrier
Entra joined devices can still sign in to resources that rely on Active Directory, including file shares. Users sign in with their Microsoft 365 account, and Windows quietly gets access to on-premises resources in the background. Users carry on opening file shares as they always have.
Two things need to be in place: user accounts must sync from Active Directory to Entra ID, and the device must be able to reach a domain controller, either in the office or over a VPN or similar connection.
Your apps already use modern sign-in
Microsoft 365, Salesforce, Xero, MYOB, ServiceNow, HubSpot, Atlassian and thousands of other business apps use modern sign-in standards. That gives you single sign-on, multi-factor authentication (MFA), Conditional Access and better visibility of sign-ins, with no need for a domain-joined device. For most organisations, this is already how most work gets done.
Windows Hello for Business changes the security conversation
Passwords get reused, phished, guessed and stolen. Windows Hello for Business replaces them with face recognition, a fingerprint or a PIN.
A PIN looks like a password but works very differently. It’s tied to the device and protected by its built-in security chip (TPM). A stolen password can be used from anywhere in the world. A Windows Hello credential can’t be used without the device.
For users: faster sign-in, fewer passwords and fewer reset requests.
For the organisation: lower phishing risk, stronger identity protection and a solid base for Zero Trust.
Intune has grown well beyond basic device management
“We still need Group Policy” used to be a fair point. Today, Intune covers most day-to-day settings through the settings catalog, administrative templates, security baselines, endpoint security policies and custom settings. Group Policy analytics in Intune shows which of your existing policies carry across.
In most cases, the challenge isn’t a missing capability. It’s working out which of the policies built up over the years you still need.
Cloud PKI removes another server
Certificates get little attention until they stop working. Traditional Active Directory Certificate Services needs servers, monitoring, backups and ongoing care. Microsoft Cloud PKI, part of the Intune Suite or available as an add-on, issues and renews certificates for Intune-managed devices without any on-premises servers.
The hidden cost of hybrid join
Hybrid join looks like the safe middle ground. In practice, a hybrid device can depend on Active Directory, Entra ID, directory sync, Intune and Group Policy all at once. When something breaks, troubleshooting has to answer several questions:
Is the device correctly joined?
Is directory sync healthy?
Is Intune applying the right policies?
Is Group Policy overriding them?
Is the device getting the right sign-in tokens?
That adds support effort and blurs the source of truth. A cloud-native approach gives you one place to manage devices and a simpler way of running them.
Are there still genuine blockers?
Yes. Not every organisation is ready to go fully cloud-native.
Older line-of-business apps that rely on LDAP, NTLM or hard-coded domain dependencies.
Industry-specific platforms in manufacturing, healthcare, engineering or industrial settings that haven’t been modernised.
Heavily customised environments with hundreds of Group Policies built up over many years. This is usually a question of migration effort, not a limitation of Entra join.
The key is to test these dependencies, not assume them. Many organisations stay on hybrid join for a dependency that turns out not to exist.
What’s in it for your business?
Less infrastructure. Fewer servers to patch, back up and monitor.
Stronger security. Passwordless sign-in, Conditional Access and device compliance work together.
Faster device rollout. Windows Autopilot ships devices straight to users, ready to work.
Simpler support. One management plane and a clear source of truth.
How we help
At Hivemind Solutions, we help organisations move to Entra joined devices without disrupting the way people work.
Map your dependencies. We review the apps, file shares, printers, certificates and Group Policies your devices rely on today.
Separate real blockers from assumed ones. We test what genuinely needs a domain-joined device.
Pilot with real users. We deploy Entra joined devices through Windows Autopilot to a small, representative group.
Give you a clear plan. You get a roadmap to make Entra join the default for new and refreshed devices.
Frequently asked questions
Do we still need a VPN?
Not always. Many apps are already online and use Entra ID sign-in. Where you still have on-premises resources, remote users need some way to reach them. Microsoft Entra Private Access can replace a traditional VPN for many of these cases.
Can Entra joined devices access file shares?
Yes. As long as user accounts sync from Active Directory and the device can reach a domain controller, users can keep opening file shares without hybrid join.
Is Windows Hello less secure than a password?
No. It’s usually much more secure, because the credential is tied to the device and protected by hardware.
Is hybrid join being retired?
No. It’s still fully supported. Many organisations now see it as a transition step rather than the long-term goal.
How do we know if we’re ready?
Assess your apps and dependencies. Most organisations find they’re closer to a cloud-native model than they expected.
Further reading
What are cloud-native Windows endpoints?ㅤ❯
How SSO to on-premises resources works on Entra joined devicesㅤ❯
Microsoft Cloud PKI for Microsoft Intuneㅤ❯
Related services
Ready to leave hybrid join behind?
Book a free conversation with our team. We’ll look at your current setup and show you what a move to Entra joined devices looks like for your business.