Seeing a work account under Windows settings does not necessarily mean a computer is joined to the clinic’s Microsoft Entra tenant. Registered and joined devices serve different purposes, and confusing them can derail workstation deployment.
Entra registered
- Registration is commonly used when a work account is added to a personal or otherwise independently managed device.
- The user generally continues signing into Windows with an existing local or personal account.
- Registration gives the organization a device identity for supported access scenarios, but it is not the same as making the organization the Windows sign-in authority.
Entra joined
- A joined Windows device is connected directly to the organization’s Microsoft Entra tenant.
- Authorized organizational users can sign into Windows with their work accounts, subject to tenant configuration and licensing.
- Joined devices can participate in centralized management and security controls when the clinic has the required services and policies.
Why the distinction matters during deployment
- Adding a work account after setup does not automatically convert every computer into a properly joined organizational device.
- The intended sign-in model should be chosen before configuring user profiles and applications.
- Each user’s cloud account, password, MFA registration, and licensing should be tested before relying on first sign-in at the workstation.
- A documented local recovery path should be maintained without leaving unnecessary everyday administrator access.
Verify the actual state
- Review Settings > Accounts > Access work or school.
- Use the Windows dsregcmd /status command when technical confirmation is needed.
- Confirm the device appears in the correct tenant and that the expected user can sign in.
- Document whether the device is registered, joined, hybrid joined, or intentionally local.
Authoritative references
Related ClinicsIT guidance
Practical note: Technology, licensing, and regulatory requirements vary by organization. Confirm the current configuration and applicable obligations before making changes.
Registration and joining are not the same
A registered device is often still a personal or locally managed computer with a work account added for selected applications. A joined device uses the clinic's Entra identity as the Windows sign-in authority. Seeing an account under Access work or school does not by itself prove that Windows is fully Entra joined.
Two common scenarios
Scenario one: an employee signs into Office on a local Windows profile and allows the work account to be added. The device may appear registered, but employees still sign into Windows with the local account.
Scenario two: the computer is joined through Windows settings or initial setup. The employee signs into Windows using the clinic account, and the device appears as Entra joined in the tenant.
What changes during a join
Joining can create a new Windows profile. Existing desktop files, browser data, saved credentials, and application settings from the prior local profile do not automatically move. Inventory and migrate required data before removing the old profile.
Avoid allowing the wrong employee to become the initial local administrator. Decide in advance who performs the join, which administrative identities are retained, and how the user will be assigned standard access.
Post-join verification
Confirm the device state, test the intended employee sign-in, verify administrator access, restart the computer, test cached sign-in, confirm BitLocker recovery-key ownership where applicable, and test every required application, printer, scanner, and shared folder.
Need help applying this to your clinic?
ClinicsIT can review the current environment and build a practical, documented next-step plan.
Request a consultation