New Windows devices should default to Entra join instead of hybrid join

In a lot of the tenants I work with, new Windows devices still get hybrid joined by default, and often the only reason is "that's how we've always done it." That habit keeps classic Active Directory dependencies and extra complexity alive, and most modern workplaces don't need either anymore. Moving from hybrid join to Entra join is easier in 2026 than it has ever been, on the technical side and the organisational side. What matters is figuring out where hybrid is actually required and moving everything else to a simpler setup that is managed entirely from the cloud.

Entra join registers devices in Entra ID alone, unlike hybrid join

For years, hybrid join was the standard way to manage Windows PCs in both on-prem AD and Entra ID (formerly Azure AD). That made sense back when most resources (file shares, old printers, authentication for legacy apps) were tied to the local domain and Group Policy Objects (GPOs) ran everything. With Entra join, a device is registered only in Entra ID. You get modern management, automation and security, and thanks to cloud Kerberos trust, Entra joined devices can now reach classic AD resources such as SMB file shares and Kerberos-authenticated apps directly, without any AD device object. I've written up the practical setup and the caveats in my post on cloud Kerberos trust and Hello for Business.

This is roughly how I decide for new devices:

flowchart TD
  Start["New device"] --> CheckAD["Needs on-prem AD?"]
  CheckAD -->|"No"| EntraJoin["Entra join (Autopilot)"]
  CheckAD -->|"Yes"| HybridJoin["Hybrid join"]
  EntraJoin --> Management["Intune management"]
  HybridJoin --> Management
  Management --> Resources["Cloud & on-prem resources"]

Figure: Choosing between hybrid join and Entra join for new PCs.

Very few workloads still need classic Active Directory

When I go through the actual requirements with customers, the list of things that really depend on traditional AD gets shorter every year. Entra joined devices can now open file shares through cloud Kerberos trust, provided your core infrastructure is ready (Windows Server 2022 DCs, patching, trust configuration). Printing is covered for most scenarios by Universal Print and modern IPP, with no AD group membership involved. What remains as a real blocker are legacy apps that still need a computer account in AD for authentication, and those are usually systems that are due to be retired anyway. I keep hybrid join for them as a targeted exception. For the bulk of end-user laptops and desktops, they're no longer a reason to stay away from Entra join.

GPOs used to be the main argument for hybrid join. Today the Intune settings catalog and security baselines handle almost every Windows and Office configuration you're likely to need. If you're migrating, start with Group Policy analytics in Intune. It tells you which GPO settings MDM (Intune) already covers and where the gaps are.

Practical tip: Running your GPOs through Group Policy analytics often turns up a pile of old policies nobody uses anymore. Clear those out before you move to Entra join. You'll have less to migrate, fewer surprises and a much smoother rollout.

Autopilot and the settings catalog make Entra join easy in practice

Provisioning new devices is where Entra join pays off most. In Autopilot's user-driven mode, the device registers directly into the tenant, the user signs in with Entra ID, and Intune takes care of all the management. You don't need AD join scripts, you don't fight broken GPOs, and you don't need legacy VPN access during setup. Onboarding goes more smoothly and fails far less often. I see that consistently, mid-sized environments included.

Intune is now where device configuration lives. The settings catalog grows with every release, and for anything it doesn't cover yet you can push PowerShell scripts or custom ADMX templates through Intune. That can mean some extra work at the start, but it pays for itself quickly once you stop dealing with AD sync problems and legacy troubleshooting.

Hybrid join stays an exception and stale devices need regular cleanup

These days I rarely see a reason to hybrid join everything. Specialist kit like lab equipment, older hardware or legacy software that genuinely depends on AD can stay on hybrid join as a documented exception. Every other new device should get Entra join by default wherever possible.

One anti-pattern I run into all the time is stale hybrid joined devices that have sat forgotten in the tenant for months or even years. They cause security and compliance problems and clutter up device reports. The most reliable cleanup is a regular review in the Entra ID portal (Entra ID → Devices → All devices), where you can filter by last activity and delete the dead objects. If you want to automate it, use PowerShell 7 with the Microsoft.Graph.DeviceManagement.Administration module (Entra ID P1 required):

# List devices inactive for over 60 days
Get-MgDevice | Where-Object { $_.ApproximateLastSignInDateTime -lt (Get-Date).AddDays(-60) }
# To remove: use Remove-MgDevice for targeted cleanup

It is time to break the hybrid join habit and document the exceptions

Plenty of admins are wary of moving from hybrid join to Entra join because they still remember how rough cloud management was in the early days. In 2026, though, Entra join and Intune cover most requirements without much effort, and real AD dependencies are rare. My advice is to use Group Policy analytics to see what your GPO footprint actually looks like, clean out unused device objects and go cloud-native wherever you can. Write down the genuine exceptions, but make Entra join the default for new devices. You'll be glad you did later, and so will your security posture.