On the Access work or school page, two options look alike, and the one you pick decides whether your organization manages this PC. Typing your email in the first box only registers it. To join, go to Settings, then Accounts, then Access work or school, and select Connect. Then choose the Join this device link at the bottom, sign in, confirm the organization, select Join and Done, and restart.
Azure Active Directory (Azure AD) is now Microsoft Entra ID; both names mean the same join.
Join or just add a work account? Pick before you click
A join hands the PC’s sign-in to your organization: you sign in to Windows with your work account, and IT can apply policies such as encryption, password rules and updates through a management tool like Microsoft Intune. Microsoft’s Microsoft Entra joined devices overview lists the device owner as the organization. Registering is lighter: you keep your own sign-in and simply give apps access to work email and files.
| Your situation | What to choose | Result |
|---|---|---|
| The organization bought the PC or asked you to join it | Connect, then the Join this device link | Microsoft Entra joined; work account signs in to Windows |
| Your own laptop, you only need Outlook, Teams or OneDrive for work | Connect, then type your email in the box and select Next | Registered; your personal sign-in stays in charge |
| The office still runs an on-premises Active Directory domain | Ask IT; this is set up from their side | Hybrid joined (see how hybrid join works on Windows 10) |
| The PC runs Windows 11 Home (check Settings, then System, then About, under Edition) | Register only, or upgrade the edition first | Home editions do not support Microsoft Entra join; Pro, Enterprise and Education do |
| You are signed in with the built-in local Administrator account | Switch to a normal local account that has administrator rights, then join | Microsoft’s device identity FAQ notes that joins can fail from the built-in Administrator |
Whichever account you join from, keep a local administrator account on the PC afterward, because you need it to disconnect the PC later. If you do not have one yet, see creating a local account on Windows 11. You also need an internet connection for the whole process, and your organization must allow users to join devices (an IT setting covered in the diagnosis section). The steps are the same on Windows 10, which Microsoft also supports for Entra join. If you are unsure which row fits, ask IT before joining.
Join a PC that is already set up
- Press Windows key + I to open Settings, then select Accounts and Access work or school.
- Next to Add a work or school account, select Connect. A Microsoft account window opens with an email box.
- Do not type in that box yet. At the bottom of the window, select the Join this device link. Depending on the build, it reads Join this device to Microsoft Entra ID or Join this device to Azure Active Directory; Microsoft’s own support page still uses the older wording.
- Enter your full work or school email address (for example [email protected]), select Next, enter the password and select Sign in.
- Approve the sign-in on your phone or enter the code if your organization uses multifactor authentication.
- On Make sure this is your organization, check that the organization name and your account are right, then select Join.
- When You’re all set appears, select Done.
- Restart the PC. Sign in with the work email and password; if the sign-in screen shows only your old account, choose Other user first.
- If Windows asks you to set up Windows Hello, create the PIN or fingerprint. Many organizations require it before you reach the desktop.
- Expect a fresh desktop. The work account gets its own user profile. Files from your earlier local account are not moved into the new profile; copy over what you need while signed in to the old account, or ask IT where they want work files kept.
- Give it a few minutes. When you join through Settings or setup, Microsoft says the person who joins becomes the primary user and a local administrator by default, unless IT changes that. If your organization has automatic Intune enrollment, policies and apps start arriving during or after this first sign-in.
These steps follow Microsoft’s join your work device support article and apply to current versions of Windows 11.
Join a new or reset PC during setup
On a PC fresh out of the box, or one you just reset, the join can happen during the first setup screens instead. Microsoft’s out-of-box join instructions cover this route.
- Work through region, keyboard and network. Setup needs an internet connection for the join.
- If Windows asks How would you like to set up this device?, choose Set up for work or school and select Next. On many current builds, the Sign in with Microsoft screen simply accepts a work email directly.
- Enter your work email, select Next, enter the password and complete any approval on your phone.
- Finish the remaining screens, including Windows Hello setup if your organization requires it. The PC may restart a few times.
The first sign-in then looks the same as steps 10 and 11 of the Settings route. Organizations that hand out many PCs often use Windows Autopilot or bulk enrollment instead, which IT configures in advance; in that case you just sign in when setup asks.
Diagnose the join: what dsregcmd and the error tell you
Back in Settings, Accounts, Access work or school, a joined PC shows text like Connected to your organization’s Entra ID. For a precise answer, or when the join did not go through, open Terminal or Command Prompt while signed in with the account you want to check and run:
dsregcmd /status
Microsoft’s dsregcmd reference explains each line. Match what you see with the table, starting from the top.
| What you see | What it means | What to do |
|---|---|---|
| AzureAdJoined : YES | The PC is joined to Microsoft Entra ID | Nothing; the join worked |
| AzureAdJoined : YES and DomainJoined : YES | The PC is also joined to an Active Directory domain, which means hybrid join | Nothing, if IT planned it that way |
| AzureAdJoined : YES but AzureAdPrt : NO | No Primary Refresh Token (the token that gives single sign-on to work apps) for the account you ran the command from | See the note under the table |
| AzureAdJoined : NO, and no Join this device link in Settings | Windows 11 Home, or the PC is already joined or registered | Check the edition, or disconnect the existing account first |
| A message that you cannot join or are not allowed | The Users may join devices to Microsoft Entra setting excludes you | IT administrator |
| A message about reaching a device limit | You hit the Maximum number of devices per user | IT administrator (or remove an old device) |
| The join fails with an error code | Joining from the built-in Administrator account, a network problem, or a conditional access rule | Fix the account or network first, then send the code to IT |
AzureAdPrt only reports on the account you are signed in with, so it shows NO when you run the command from a local account. Sign out, sign in with the work account, wait a minute and run it again. If it still says NO, send the full output to IT.
For IT readers, Microsoft’s device settings documentation says Users may join devices to Microsoft Entra defaults to All, the maximum number of devices per user defaults to 50 and can be raised to 100, and the option to require multifactor authentication to register or join devices defaults to No. Joined devices show in the Microsoft Entra admin center under Entra ID, then Devices. Error details on the PC often appear in Event Viewer under Applications and Services Logs, Microsoft, Windows, User Device Registration, Admin.
Disconnect the PC from Entra ID
Before you start, make sure you know the password of a local administrator account. After the disconnect, the work account can no longer sign in to this PC.
- Sign in, open Settings, then Accounts, then Access work or school.
- Select the connected work or school account, then select Disconnect and confirm.
- Enter the local administrator user name and password when Windows asks.
- Restart, then sign in with the local account. For more on that, see signing in with a local account instead of a work account.
Let IT know so they can delete the device record in their admin center; otherwise it keeps counting toward your device limit.
Work account join questions
Can I join a PC that has more than one person using it?
Yes. After the join, other people in the organization can sign in with their own work accounts from the sign-in screen. Microsoft notes that people who have signed in before can still sign in later without internet, using cached credentials.
Does joining start Intune enrollment on its own?
Only if your organization has set up automatic enrollment for your account. Otherwise the PC is joined but not managed by Intune, and IT may enroll it separately.
Next step: run dsregcmd /status once after your first work sign-in. If AzureAdJoined and AzureAdPrt both say YES, the PC is set up and ready.
Kermit Matthews runs Live2Tech from just outside Philadelphia. He is an IT specialist with over 20 years of experience, from a university help desk to small-business IT, IT management and his own consulting practice, and has written tech guides full time since 2020. Steps are checked against the current software on a real device or the maker’s official documentation. More about Kermit.