Cascade Regional Airlines' HQ desktops have been domain-joined to on-premises Active Directory for years, and the identity admin now wants those same machines to also register with Microsoft Entra ID so users can access cloud apps with conditional access enforced, without a disruptive re-image of every machine. What device join type describes the end state?

Hybrid Microsoft Entra join describes a device that is already joined to an on-premises Active Directory domain and is additionally registered with Microsoft Entra ID, typically through Microsoft Entra Connect synchronizing the device object to the cloud. That dual-registration mechanism is precisely how existing domain-joined HQ desktops gain conditional access enforcement and cloud app access without any re-image or disruptive rejoin — the on-prem AD relationship stays intact while Entra ID gains visibility into the device. Microsoft Entra registered is for personal or BYOD devices adding a work account alongside a personal one; it doesn't apply to machines already fully domain-joined and doesn't require or reflect existing AD membership. Microsoft Entra joined is a cloud-native, non-hybrid state where the device has no on-premises AD dependency at all — using it here would mean unjoining from the existing domain, which is the disruptive path the admin is trying to avoid. Workgroup-joined with local accounts removes centralized directory control entirely and moves backward, not forward, from the existing domain-joined state. An exam-relevant caveat: hybrid join requires the on-premises AD forest to be federated or synced with password hash sync or pass-through authentication via Entra Connect. An operational check is confirming the device shows both an AD computer object and a matching Entra ID device object with join type Microsoft Entra hybrid joined.