SSO differences between Entra ID joined devices and others

Question

SSO differences between Entra ID joined devices and others

passione 120

Hello everyone,

I want just to ask if there are any difference on how an SSO implementation of Entra ID could work on joined/Hybrid joined/registered devices and unregistered devices.

Thanks.

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-04-30T15:18:43.7766667+00:00

Hello passione,

Yes, there are differences in how Single Sign‑On (SSO) works, depending on the device state in Microsoft Entra ID.

On Entra ID joined and Hybrid Entra ID joined devices, the user receives a Primary Refresh Token (PRT) at Windows sign‑in, which enables seamless SSO across Microsoft 365 and Entra‑integrated applications.

On Entra ID registered devices, SSO is more limited because the device is not fully trusted; users may need to sign in to an app first before SSO applies.

On unregistered devices, no device trust exists, so users are typically prompted to authenticate more frequently.
passione 120 Reputation points

2026-04-30T17:56:06.3566667+00:00

Hi @VEMULA SRISAI
What does it mean that on unregistered device is more frequently? Because the only differences I see is in terms of browser-reacheable apps where you need to Sign-in just one time to access everything (without closing the browser of course, if not the session cookie with entra id are gone if i understood correctly). I don't understand the registered device case, though.

Thanks for your response
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-05-05T19:27:36.6066667+00:00

passione What you’re observing is correct. On an unregistered device, SSO is purely browser‑session based. You sign in once in a browser and can access other Entra‑integrated web apps until the browser session expires, cookies are cleared, or Conditional Access requires re‑authentication. There is no device trust involved, so once the session is gone, sign‑in is required again.

For Entra ID registered devices, the difference is that the device has an identity in Entra ID, but it’s not fully trusted. You still need to sign in to the first app or browser, after which limited SSO works for that session. However, since no Primary Refresh Token (PRT) is issued at Windows sign‑in, SSO is not seamless across the OS and apps like it is on joined devices.

Only Entra ID joined or Hybrid joined devices receive a PRT during Windows sign‑in, which enables true device‑level SSO without repeated authentication prompts.

1 answer

Your answer

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-04-30T15:18:43.7766667+00:00

Hello passione,

Yes, there are differences in how Single Sign‑On (SSO) works, depending on the device state in Microsoft Entra ID.

On Entra ID joined and Hybrid Entra ID joined devices, the user receives a Primary Refresh Token (PRT) at Windows sign‑in, which enables seamless SSO across Microsoft 365 and Entra‑integrated applications.

On Entra ID registered devices, SSO is more limited because the device is not fully trusted; users may need to sign in to an app first before SSO applies.

On unregistered devices, no device trust exists, so users are typically prompted to authenticate more frequently.
passione 120 Reputation points

2026-04-30T17:56:06.3566667+00:00

Hi @VEMULA SRISAI
What does it mean that on unregistered device is more frequently? Because the only differences I see is in terms of browser-reacheable apps where you need to Sign-in just one time to access everything (without closing the browser of course, if not the session cookie with entra id are gone if i understood correctly). I don't understand the registered device case, though.

Thanks for your response
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-05-05T19:27:36.6066667+00:00

passione What you’re observing is correct. On an unregistered device, SSO is purely browser‑session based. You sign in once in a browser and can access other Entra‑integrated web apps until the browser session expires, cookies are cleared, or Conditional Access requires re‑authentication. There is no device trust involved, so once the session is gone, sign‑in is required again.

For Entra ID registered devices, the difference is that the device has an identity in Entra ID, but it’s not fully trusted. You still need to sign in to the first app or browser, after which limited SSO works for that session. However, since no Primary Refresh Token (PRT) is issued at Windows sign‑in, SSO is not seamless across the OS and apps like it is on joined devices.

Only Entra ID joined or Hybrid joined devices receive a PRT during Windows sign‑in, which enables true device‑level SSO without repeated authentication prompts.

Answer 1

SSO behavior in Microsoft Entra ID differs mainly based on whether the device has a cloud device identity (joined/hybrid joined/registered) and which SSO mechanism is used.

Device types and SSO mechanism

Microsoft Entra joined devices
- Device is joined directly to Microsoft Entra ID (no on-prem AD join).
- SSO is provided via the Primary Refresh Token (PRT), not Kerberos.
- Gives SSO to Microsoft Entra–protected apps and, when the device can reach a domain controller, SSO to some on-premises resources as well.
- SSO works automatically in Microsoft Edge and in Chrome with the browser extension.
- Authentication uses modern OAuth/OpenID Connect protocols over the internet.
Hybrid Microsoft Entra joined devices
- Device is joined to on-premises AD and registered in Microsoft Entra ID.
- Also uses PRT-based SSO for Microsoft Entra–protected resources.
- Can additionally use Kerberos/NTLM for on-premises apps because the device has an on-prem computer account.
- SSO via PRT is the recommended method on Windows 10/11 and takes precedence over Seamless SSO when both are enabled.
Microsoft Entra registered devices (personal/BYOD)
- Device is not domain-joined; a work/school account is added (“Add work or school account”).
- Device gets a cloud identity and uses PRT-based SSO to Microsoft Entra–protected apps.
- Good for BYOD scenarios; still supports Conditional Access and compliance when managed.
Unregistered devices
- No device object in Microsoft Entra ID.
- No PRT, so no device-based SSO.
- Users authenticate per app/session (e.g., interactive sign-in, possibly Seamless SSO if the device is domain-joined and on-prem, but not Entra joined/registered).
- Conditional Access can’t evaluate device state (compliant, hybrid joined, etc.), so device-based controls don’t apply.

Seamless SSO vs PRT-based SSO

Seamless SSO
- Signs users in automatically when on a domain-joined device on the corporate network.
- Works with Password Hash Sync or Pass-through Authentication.
- Not used on Windows 10 Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered devices.
SSO via PRT
- Recommended for Windows 10, Windows Server 2016, and later.
- Used on Microsoft Entra joined, hybrid joined, and registered devices once they are registered with Microsoft Entra ID.
- Provides SSO to Microsoft Entra–protected apps and is the primary SSO mechanism for those device states.

Impact on Conditional Access and management

Microsoft Entra joined / Hybrid joined
- Device has a cloud identity, can be managed by Intune, and supports device compliance and Conditional Access policies.
- Hybrid joined also has an on-prem AD identity and can use GPOs and on-prem auth (Kerberos/NTLM).
Microsoft Entra registered
- Device identity exists in Entra ID; can be managed (e.g., via Intune) and participate in Conditional Access based on device compliance.
Unregistered
- No device identity in Entra ID; Conditional Access can only use user and session signals, not device state.

In summary: joined, hybrid joined, and registered devices all use PRT-based SSO and support richer Conditional Access and management. Unregistered devices lack PRT-based device SSO and device-based Conditional Access.

References: