The practical distinction is simple: registration connects an existing device or profile to clinic services, while joining makes Microsoft Entra the organizational identity used for the Windows device. Both states can appear under Access work or school, so the settings screen alone is easy to misread.
Do not choose the device state after the computer is already built
Decide the sign-in model, administrator plan, licensing, management method, user assignment, recovery process, and profile-migration needs before deploying applications and handing the computer to staff.
Registered vs. joined at a glance
| Question | Microsoft Entra registered | Microsoft Entra joined |
|---|---|---|
| Windows sign-in | Usually an existing local or personal Windows account. | An authorized clinic Microsoft Entra account signs into Windows. |
| Typical purpose | Connect a personally owned or independently managed device to selected work resources. | Establish an organization-owned Windows device with clinic-controlled identity. |
| Device ownership model | The device can remain personal or locally managed even though a work account is present. | The device is associated directly with the clinic’s Microsoft Entra tenant. |
| Windows profile | The existing Windows profile generally remains the primary profile. | The organizational sign-in can create a separate Windows profile that must be configured and validated. |
| Central management | Available controls depend on enrollment, policy, licensing, and the connected application. | Can participate in centralized management and security controls when the clinic deploys the required services and policies. |
| Local administrator risk | Existing local-account permissions continue unless deliberately changed. | The identity performing the join and configured Entra roles can affect local administrator membership, so the join process must be planned. |
| Best clinic use | Limited work access on a device that is intentionally not being converted into a clinic-managed Windows endpoint. | Clinic-owned workstations intended for standardized employee sign-in, support, security, and lifecycle management. |
Two clinic scenarios that look similar
Office apps were connected to a local Windows profile
An employee signs into Windows with a local account, opens Microsoft 365, and adds the clinic account. Outlook and other applications may work, and the device may appear in Microsoft Entra, but Windows is still using the local profile as its sign-in authority.
The clinic account is the Windows identity
The computer is joined during setup or through Windows settings. The employee signs into Windows with the clinic account, the device is associated with the clinic tenant, and the organization can apply its intended device-management and security model.
Why the distinction matters in a medical clinic
User access
Staff should know which identity opens Windows, which account controls Microsoft 365, and whether the workstation is assigned to one user or shared.
Support access
Clinics need a documented routine-support account and a tested recovery path that do not depend on the employee who originally configured the computer.
Profile migration
Desktop files, browser profiles, saved credentials, printers, scanners, shortcuts, and application settings from a local profile should be inventoried before a separate Entra profile is introduced.
Security and lifecycle
The clinic should be able to identify the device owner, remove departing-user access, recover encryption information where applicable, and rebuild or replace the computer consistently.
Joining an existing computer can create a second profile
Joining does not magically convert every setting in the existing local Windows profile. The clinic account may receive a new profile with a separate desktop, browser state, application preferences, cached credentials, and user-specific folders.
- Inventory files and settings in the old profile before joining.
- Confirm whether OneDrive, Shared Drives, or local folders contain the authoritative copy.
- Record required applications, printers, scanners, mapped locations, bookmarks, and browser extensions.
- Test the employee’s password and MFA before relying on first sign-in.
- Keep the old profile temporarily until the new profile has been validated and the clinic approves removal.
Plan local administrator access before the join
The person who performs an Entra join can affect local administrator membership. A clinic should not casually let whichever employee opens the box become the permanent device administrator.
- Choose who performs the join and which clinic-controlled administrative identity is used.
- Separate routine employee access from support and emergency administration.
- Document which Entra roles or local groups provide administrator rights.
- Test administrative access after a restart and after the intended employee signs in.
- Avoid removing the final known recovery path until the replacement path has been proven.
Registration is not a halfway-completed join
A registered computer may be exactly what the organization intended for a personal or independently managed device. The problem is not registration itself—the problem is assuming a registered device has the same Windows identity, ownership, support, and management model as a joined clinic workstation.
How to verify the actual device state
- Review Settings > Accounts > Access work or school, but do not rely on the presence of an account alone.
- Run
dsregcmd /statuswhen technical confirmation is needed. - Look for
AzureAdJoined : YESwhen confirming a Microsoft Entra joined device. - Review
WorkplaceJoinedin the user-state portion when investigating registration. - Confirm the device object appears in the correct Microsoft Entra tenant and matches the physical workstation.
- Test the intended employee sign-in, restart behavior, cached sign-in, support access, required applications, printers, scanners, and shared files.
A practical clinic deployment decision
Choose registered when…
The device is intentionally personal or independently managed, the user keeps the existing Windows sign-in, and the clinic only needs approved access to selected organizational resources.
Choose joined when…
The computer is clinic-owned and should use clinic identity, standardized employee sign-in, documented support access, centralized policy, and a repeatable replacement process.
No device state substitutes for an actual deployment plan. Licensing, management enrollment, security policy, application compatibility, user role, and recovery documentation still need to be decided.
Frequently asked questions
Does adding a work account mean the computer is Entra joined?
No. Adding an account can register the device or connect applications without changing the Windows sign-in authority.
Can staff sign into Windows with the clinic account on a registered device?
A registered computer normally continues using its existing local or personal Windows sign-in. A joined computer uses the organizational account as the Windows identity.
Will joining preserve the old Windows profile?
Do not assume it will. Treat the Entra sign-in as a potentially separate profile and plan the required migration and testing.
Does Entra join automatically make the computer fully managed?
No. Joining establishes device identity. Broader management and compliance depend on the clinic’s licensing, enrollment, configuration, and policies.
Related ClinicsIT guidance
Authoritative Microsoft references
- Microsoft: Microsoft Entra registered devices
- Microsoft: Microsoft Entra joined devices
- Microsoft: Verify and troubleshoot device state with dsregcmd
- Microsoft: Manage local administrators on Entra joined devices
Practical note: Microsoft licensing, Windows edition, device-management configuration, security requirements, and existing profile conditions vary. Confirm the actual tenant and workstation state before changing sign-in or removing a working recovery path.
Not sure what state your clinic computers are in?
ClinicsIT can inventory the current sign-in model, verify device state, identify administrator and profile risks, and build a practical workstation-standardization plan.
Request a Clinic Workstation Review