Tenant ID location for Intune-only enrolled devices

Question

Tenant ID location for Intune-only enrolled devices

Naija R C 40

Hi ,

I’m trying to identify where the Azure AD / Entra ID Tenant ID is stored on a Windows device that is enrolled only in Intune (MDM-only), and not Azure AD joined or Hybrid joined.

On Azure AD–joined or Hybrid devices, the tenant ID can typically be found under the registry path:

SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo

However, on Intune-only enrolled devices, I do not see the tenant ID present under this registry location.

My questions:

Is the tenant ID stored anywhere in the Windows registry for Intune-only (MDM-enrolled) devices?

If yes, what is the exact registry path used?
If not, is there an official or supported method to retrieve the tenant ID locally from an Intune-only enrolled device ?

Any clarification on how tenant identification works for Intune-only enrollment would be appreciated.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Jose Benjamin Solis Nolasco 7,376

Welcome to Microsoft Q&A

Hello Naija R C,

I see the issue. You are checking the registry folder used for "Corporate Owned" (Joined) devices. Since your device is "Intune-only" (which usually means it is a personal device or "Registered" rather than "Joined"), Windows stores the ID in a different spot.

Where to find it in the Registry:

Instead of CloudDomainJoin, look here:

Open Registry Editor (regedit).

Go to: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\TenantInfo

Expand the TenantInfo folder. You should see a folder with a long code (GUID). That folder name is your Tenant ID.

(If you don't see it there, try the same path but start with HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER).

The Official Way to check:

You don't usually need to dig in the registry. You can ask Windows to tell you directly:

Open Command Prompt (cmd.exe).
Type dsregcmd /status and hit Enter.
Scroll down to the "User State" section.
You should see WorkplaceJoined : YES. The details near that line will confirm which Tenant account is connected.

You can find some useful information in this blog about intune https://msendpointmgr.com/2024/10/12/unpacking-the-microsoft-intune-mdm-certificate/

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily.

Naija R C 40 Reputation points

2026-02-10T10:24:31.39+00:00
Thanks for the explanation.

I understand that for Azure AD–joined, Hybrid joined, or Azure AD–registered (Workplace joined) devices, the tenant ID can be retrieved from the registry (for example under CloudDomainJoin or WorkplaceJoin paths).

However, the challenge I am facing is with the following scenario:

The device is not Azure AD joined, not Azure AD registered, and not Hybrid joined

On this device, I used “Enroll only in device management” from Windows Settings to enroll it into Intune (MDM-only)

After enrollment, I ran dsregcmd /status

The output does not show any tenant information (Tenant ID is missing – results attached) and MDM information. As suggested, I also checked the registry paths:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\TenantInfo

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\TenantInfo

None of these locations contain the tenant ID (screenshots attached for reference)

Could you please confirm whether:

The tenant ID is stored anywhere locally for this enrollment type, or

There is no supported way to retrieve tenant information locally for MDM-only enrollment, and it is expected behavior?

Any clarification would be appreciated.
Jose Benjamin Solis Nolasco 7,376 Reputation points

2026-02-10T14:57:45.9366667+00:00

Hello Naija R C,

Thank you for the detailed clarification and screenshots. This explains exactly why the previous commands failed.

Since you used "Enroll only in device management," the device is strictly MDM-managed but has no identity relationship (Registration/Join) with Entra ID. Therefore, dsregcmd (which reports on the identity stack) and the CloudDomainJoin/WorkplaceJoin keys (which store identity artifacts) are expected to be empty.

In this specific scenario, the Tenant ID is not stored in plain text in the standard registry hives. It is encapsulated within the mTLS client certificate issued during the MDM handshake.

Here is how to retrieve it:

The Registry (Indirect Identification): Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments You will see several GUID keys (e.g., "FFFF..."). Ignore the ones with all zeros. Open the keys until you find one containing a value named "UPN" that matches your account (e.g., ******@domain.com). While this confirms the enrollment exists, it rarely lists the explicit "Tenant ID" GUID in plain text for Intune-only connections; it relies on the UPN and the certificate.

The Certificate (The Definitive Location): The Tenant ID is hard coded into the Extended Key Usage or Subject Alternative Name properties of the MDM client certificate. Open Manage Computer Certificates (certlm.msc). Go to Personal > Certificates. Look for a certificate issued by "Microsoft Intune MDM Device CA". Double-click it > Details tab. Scroll down to the "Extensions" or look for the OID 1.2.840.113556.5.14. The hexadecimal value inside this field is your Tenant ID.

Enroll only in device managemen uses the OMA-DM protocol directly. It does not establish the Entra ID "Device Object" trust that writes the Tenant ID to the CloudDomainJoin registry keys.

Source information:

https://www.ninjaone.com/blog/troubleshooting-device-enrollment-failures/#:~:text=Leverage%20PowerShell%20and%20Graph%20API,MDM%20enrollment%20is%20properly%20configured.

https://msendpointmgr.com/2024/10/12/unpacking-the-microsoft-intune-mdm-certificate/#:~:text=OID%201.2.,to%20understand%20what%20they%20represent.
Jose Benjamin Solis Nolasco 7,376 Reputation points

2026-02-11T12:44:45.55+00:00

@Naija R C just following up do you need more assistance ?
Naija R C 40 Reputation points

2026-02-12T07:37:34.8566667+00:00

Thank you for the follow-up. Your explanation was very helpful and resolved my issue. I have accepted the answer.

Share via

Tenant ID location for Intune-only enrolled devices

My questions:

0 additional answers

Your answer