Conditional access user action: Register or Join device require MFA, will this apply for Hybrid Entra ID Joined?

Question

Hello team,

I am setting up a conditional access policiy with user action "Register or join devices", the documentation inform that this apply for Entra ID registered and Entra ID Joined, However, just to be 100% sure, will this user action apply also when the user try to join the device in a hybrid environment?

Will this Conditional access policy affect Microsoft Entra hybrid joined?

Answer 1

Hello @Sergio Londono,

Thank you for posting your query on Microsoft Q&A.

Regarding your setup of a conditional access policy with the user action "Register or join devices" and requiring MFA, you inquired whether this applies to Entra hybrid join devices.

This policy will only apply to Microsoft Entra registered devices and Microsoft Entra joined devices. It will not apply to Microsoft Entra Hybrid Join devices.

This policy is enforced based on the device join type. If the user action targets devices with the join type "Microsoft Entra Register" or "Microsoft Entra Join," then the policy will apply. However, for Microsoft Entra Hybrid devices, users do not perform any action such as logging in from Settings >> Accounts >> Access Work or School page. Instead, these devices are synced from on-premises to Entra via Entra Connect sync based on SCP configuration, making them Microsoft Entra Hybrid Join devices. Consequently, the conditional access policy will only apply to Microsoft Entra registered devices and Microsoft Entra joined devices.

Reference documents:

• User actions
• Microsoft Entra registered devices
• Microsoft Entra joined devices

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thanks,
Raja Pothuraju.

Answer 2

yes:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#user-actions

https://learn.microsoft.com/en-us/entra/identity/devices/concept-directory-join