KB ID 0001597

Problem

I recently did a post about Joining Azure AD. while working on that I found out there were two different Azure AD ‘States’.

• Azure AD Joined: Aimed at Corporate owned machines joined to Azure AD, (or CYOD devices).
• Azure AD Registered (Was called Workplace Joined, and still is if you work in PowerShell). Aimed at BYOD devices.

Of course your Windows clients can also still be Domain Joined, or Simply Workgroup Joined. But you can’t be Domain Joined and Azure AD Joined. Thought to be even more confusingly you can be Domain Joined and Azure AD Registered.

How To Find out if a Machine is Azure AD Joined, Azure AD Registered, or Domain Joined

Azure AD Joined

The command you need to use is;

dsregcmd /status

Look for AzureADJoined : YES. Also take a note of the DeviceId.

To check with PowerShell, first you need to connect with Connect-MsolService, then. log into Azure AD. Then you can query a DEviceId’s status with the following command.

Get-MsolDevice -DevideID {Device-ID-From Above}

Look for DeviceTrustType: Azure AD Joined.

From within Azure > Azure Active Directory > Devices > Locate the Device in question > Join Type: Azure AD Joined.

Azure AD Registered (Workplace Joined)

When a device is AD registered then it has been connected from a logged on account, that has been connected, via the Access Work or School wizard. You can see this only if you’re logged on as that user! Settings > Accounts > Access work or School > Look for an enter under ‘Connect’.

If you are not logged on as the user then run there same command we ran above;

dsregcmd /status

And look for a WorkplaceDeviceId.

Then use the same PowerShell commands as above. 

First you need to connect with Connect-MsolService, log into Azure AD. Then you can query a DEviceId’s status with the following command.

Get-MsolDevice -DevideID {Device-ID-From Above}

Look for DeviceTrustType: Workplace Joined. (Yeah very consistent, thanks Microsoft ‘half a job’ developers!)

Domain Joined

You can use the same command to view Local (On-Prem) Domain Joined status.

dsregcmd /status

And look for DomainJoined : Yes, and DomainName : {Your-Domain-Name}.

Of course as always you can see the information on your computer’s ‘Properties’, like so;

Note: An Azure AD Joined Machine does not show details here, in fact it says it’s workgroup joined! (Again thanks Microsoft, we’ve only looked here since Windows NT4, would it have been that much more work to update this as well?)

Related Articles, References, Credits, or External Links

NA