Does onedrive signing in cause Azure AD joined or registered?

Question

Does onedrive signing in cause Azure AD joined or registered?

SUIKA-5822 120

If the organiztion enabled the auto MDM enrollment, Does signing in to OneDrive with a work account in a browser or desktop app cause Azure AD joined or registered? (with selecting the "No,this app only")

And would this trigger the auto MDM enrollment?

If possible, could you please help test this? I would be extremely grateful for your help!

Thanks in advance!

Screenshot of the device registration with device management dialog.

Jose Benjamin Solis Nolasco 1,601 Reputation points

2025-05-03T17:55:20.23+00:00

@SUIKA-5822 Signing into OneDrive (desktop app or browser) using a work account typically triggers an Azure AD Registered state, not Azure AD Joined.

Azure AD Registered = Occurs when a user signs into a Microsoft 365 app (like OneDrive) on a personal (non-domain-joined) Windows device.

Azure AD Joined = Happens when the device is domain-joined or fully enrolled into Azure AD (like corporate laptops).

If the user selects "No, this app only", then the device will not be fully Azure AD joined — it will be Azure AD registered instead.

So don't worry if you want just to use a specific app with you work account just click "No, This app Only"

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Jose Benjamin Solis Nolasco 1,601 Reputation points

2025-05-05T20:16:33.68+00:00

Just following up, Do you need more guidance or assistance ?
SUIKA-5822 120 Reputation points

2025-05-06T13:28:37.1366667+00:00
Thank you for comment.

I would like to confirm if the following understanding is correct.

"dsregcmd /status in Command Prompt:

If AzureAdJoined and WorkplaceJoined both show NO, the device is neither joined nor registered.

If AzureAdJoined is NO and WorkplaceJoined is YES, the device is Azure AD registered.

If AzureAdJoined is YES, the device is Azure AD joined."

If that is correct, based on my testing, if a device only signs into a spcecific application , it appears that the device is neither Azure AD registered nor Azure AD joined.
Jose Benjamin Solis Nolasco 1,601 Reputation points

2025-05-06T13:42:55.31+00:00
Is correct @SUIKA-5822

AzureAdJoined: NO and WorkplaceJoined: NO:

The device is neither Azure AD joined nor Azure AD registered.

AzureAdJoined: NO and WorkplaceJoined: YES:

The device is Azure AD registered (also known as Workplace Joined).

AzureAdJoined: YES:

The device is Azure AD joined.

Additionally, if EnterpriseJoined is YES, the device is joined to an on-premises Active Directory (AD). A device cannot be both EnterpriseJoined and AzureAdJoined

If you have any more questions or need further clarification, feel free to ask
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-07T13:34:01.9033333+00:00

Hello @SUIKA-5822,

Following up to check if you have any further questions or query, please do let us know.
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-09T16:18:34.72+00:00

Hello @SUIKA-5822,

Following up to check if you have any further questions or query, please do let us know.
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-12T13:57:57.8366667+00:00

Hello @SUIKA-5822,

Following up to check if you have any further questions or query, please do let us know.

1 answer

Your answer

Jose Benjamin Solis Nolasco 1,601 Reputation points

2025-05-03T17:55:20.23+00:00

@SUIKA-5822 Signing into OneDrive (desktop app or browser) using a work account typically triggers an Azure AD Registered state, not Azure AD Joined.

Azure AD Registered = Occurs when a user signs into a Microsoft 365 app (like OneDrive) on a personal (non-domain-joined) Windows device.

Azure AD Joined = Happens when the device is domain-joined or fully enrolled into Azure AD (like corporate laptops).

If the user selects "No, this app only", then the device will not be fully Azure AD joined — it will be Azure AD registered instead.

So don't worry if you want just to use a specific app with you work account just click "No, This app Only"

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Jose Benjamin Solis Nolasco 1,601 Reputation points

2025-05-05T20:16:33.68+00:00

Just following up, Do you need more guidance or assistance ?
SUIKA-5822 120 Reputation points

2025-05-06T13:28:37.1366667+00:00

Thank you for comment.

I would like to confirm if the following understanding is correct.

"dsregcmd /status in Command Prompt:

If AzureAdJoined and WorkplaceJoined both show NO, the device is neither joined nor registered.

If AzureAdJoined is NO and WorkplaceJoined is YES, the device is Azure AD registered.

If AzureAdJoined is YES, the device is Azure AD joined."

If that is correct, based on my testing, if a device only signs into a spcecific application , it appears that the device is neither Azure AD registered nor Azure AD joined.
Jose Benjamin Solis Nolasco 1,601 Reputation points

2025-05-06T13:42:55.31+00:00

Is correct @SUIKA-5822

AzureAdJoined: NO and WorkplaceJoined: NO:

The device is neither Azure AD joined nor Azure AD registered.

AzureAdJoined: NO and WorkplaceJoined: YES:

The device is Azure AD registered (also known as Workplace Joined).

AzureAdJoined: YES:

The device is Azure AD joined.

Additionally, if EnterpriseJoined is YES, the device is joined to an on-premises Active Directory (AD). A device cannot be both EnterpriseJoined and AzureAdJoined

If you have any more questions or need further clarification, feel free to ask
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-07T13:34:01.9033333+00:00

Hello @SUIKA-5822,

Following up to check if you have any further questions or query, please do let us know.
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-09T16:18:34.72+00:00

Hello @SUIKA-5822,

Following up to check if you have any further questions or query, please do let us know.
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-12T13:57:57.8366667+00:00

Hello @SUIKA-5822,

Following up to check if you have any further questions or query, please do let us know.

Answer 1

Jyotishree Moharana 1,355 Microsoft External Staff Moderator

Hello @SUIKA-5822,

Based on your description Auto MDM enrollment is enabled and you want to know the behavior when User signs into OneDrive with their work or school account and receives a sign-in pop up and select No, this app only. In this scenario since the user has selected only "No, this app only” this prevents the device from being Azure AD registered, or Azure AD joined. The sign-in will only receive a token for the app login (in this case OneDrive). So, the device will not be Azure AD joined or registered. Auto MDM enrollment will not be triggered in this scenario as the user selected "No, this app only” option.

To understand the prompt more properly we will go through the actions which get executed based on the selections done in the prompt.

There are 3 selections in the prompt.

Yes, all apps: Allows your work or school account to sign you into other desktop apps and websites you use on this device.
No, this app only: Signs you into the current app only, without affecting other apps.
Allow my organization to manage this device: Enabling this allows your organization to enroll your device in Mobile Device Management (MDM), granting them the ability to manage device settings and security policies.

The different scenarios based on selections given that Auto MDM enrollment is ON:

Selecting "Yes, all apps" and checking "Allow my organization to manage this device" : Device will get registered to Entra ID (Joined in case of corporate owned device) and will get enrolled in MDM as well. All the device settings, security policies, compliance policies will get enforced. SSO experience across all MS apps.
Selecting "No, this app only" and checking "Allow my organization to manage this device" : Device will not be registered with Entra ID, since registration didn't happen MDM enrollment will also not happen. Only the current app will use your work school account other apps will remain unaffected.
Selecting "Yes, all apps" and leaving "Allow my organization to manage this device" unchecked : Device will be registered with Entra ID but MDM enrollment will not happen even though device is registered as the second option was left unchecked. SSO will work across MS apps.
Selecting "No, this app only" and leaving "Allow my organization to manage this device" unchecked : Device will not be registered with Entra ID, MDM enrollment will also not happen. Only the current app will use your work school account other apps will remain unaffected.

Document for more information: Add-your-work-or-school-account-to-a-windows-device

If you have any further questions, please do let us know.

SUIKA-5822 120 Reputation points

2025-05-06T13:31:05.59+00:00

Thanks for the help! This clarifies things perfectly!
SUIKA-5822 120 Reputation points

2025-05-06T13:35:52.4466667+00:00

By the way, if possible,

could you please review my previous comment in this Q&A and confirm that whether my understanding of the 'dsregcmd /status' is correct or not?

Thank you very much!
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-06T14:04:11.4133333+00:00

@SUIKA-5822,

WorkplaceJoined: YES, device is registered

AzureAdJoined : YES, device is joined

AzureAdJoined : YES and DomainJoined : YES, device is hybrid joined

Reference document: Troubleshoot-device-dsregcmd

PS: Whenever you want to check the device details using "dsregcmd /status" command, always make sure that you're running the command prompt as normal user account or the logged in user account, never as an administrator.
SUIKA-5822 120 Reputation points

2025-05-08T06:20:59.31+00:00

Based on the third scenario you mentioned, please take a look at the scenario described on this website .

It seems that in the case of OP, automatic MDM enrollment triggered even without the checkbox of "Allow my organization to manage this device".

He even said that he did not enable auto-enrollment in the end of post.

How come it ended up like this??
SUIKA-5822 120 Reputation points

2025-05-08T14:41:31.6066667+00:00

If possible, could you please help test that whether the third scenario will trigger MDM auto-enrollment or not? I would greatly appreciate it! Thank you very much!
Jyotishree Moharana 1,355 Reputation points Microsoft External Staff Moderator

2025-05-08T16:47:21.5066667+00:00

@SUIKA-5822,

About the reddit post, we cannot be sure of the configuration the OP has in their environment and if they are only using Microsoft MDM solution or any third party as well, we won't be able to provide any conclusive comment over that issue.

But in the current scenario if the user select "Yes, all apps" but leaves “Allow my organization to manage this device” unchecked only device registration is initiated, Device is not enrolled in MDM (e.g., Intune), even if auto-enrollment is configured.

Even though auto MDM enrollment is enabled in Entra ID, the user must explicitly agree to device management for MDM to start. By not checking the box, they are opting out of MDM.

We have the documentation as well, please refer below screenshot.

If you have any further question or query, please do let us know.

Share via

Does onedrive signing in cause Azure AD joined or registered?

1 answer

Your answer