To Azure AD join a Windows 11 PC, open Settings, select Accounts > Access work or school > Connect, choose Join this device to Microsoft Entra ID, and sign in with your work or school account. Azure Active Directory is now named Microsoft Entra ID, so Microsoft’s current documentation calls this a Microsoft Entra join.
Applies to: Windows 11 Pro, Enterprise and Education (not Home).
What an Azure AD (Microsoft Entra) join does
Joining connects the whole PC to your organization’s cloud directory. After the join, you sign in to Windows with your work or school account instead of a personal one, and your IT department can manage the device. Joined devices are organization-owned, with single sign-on to work resources and support for Conditional Access, which is a set of rules an organization uses to decide which devices can reach its data.
Microsoft renamed Azure Active Directory to Microsoft Entra ID; existing sign-in addresses, features and licensing stayed the same. Some Windows 11 screens and tools still use the old name, so treat “Azure AD join” and “Microsoft Entra join” as the same task.
Joining is different from two similar options that live in the same part of Settings:
| Option | Meant for | How you sign in to Windows |
|---|---|---|
| Microsoft Entra join (this guide) | PCs owned by the organization | With the work or school account |
| Microsoft Entra registration (adding a work or school account) | Personal, bring-your-own devices | With your own local or personal account |
| Active Directory domain join | PCs on a company’s on-premises network domain | With a domain account |
If your company uses an on-premises domain, add the Windows 11 computer to the domain instead.
Before you start
- Windows edition: Windows Home editions do not support Microsoft Entra join. You need Pro, Enterprise or Education. A Home PC can still be registered with a work or school account.
- Administrator account on the PC: Windows only lets you connect to a Microsoft Entra domain while you are signed in as an administrative user. A join can also fail without any error message if you are signed in with the local built-in administrator account, so use a different local administrator account.
- Work or school account: You need the email address and password your organization gave you, plus your phone or other verification method if your organization requires a second sign-in step.
- Internet connection: The PC must be online to complete the join.
- Permission from your organization: Administrators control who can join devices with the Users may join devices to Microsoft Entra ID setting. It defaults to All, but your organization may have limited it to selected people.
- No conflicting connection: A PC can be connected to only one Microsoft Entra domain at a time. It cannot be joined to an Active Directory domain and a Microsoft Entra domain together, and it cannot be joined while the same PC is already connected to a work or school account. If the PC is already managed by mobile device management (MDM), it has to be unenrolled first.
Warning: Joining hands control of the PC to the organization. It can apply security policies, install apps and enroll the PC in a management service such as Microsoft Intune. Do not join a PC you own personally unless your IT department tells you to. Adding a work account for apps is usually the better choice for a personal PC.
Join Windows 11 to Azure AD from Settings
Use this method on a PC that is already set up and that you can sign in to.
- Open Settings, and then select Accounts. The Accounts page lists your sign-in and account options.
- Select Access work or school, and then select Connect. A setup window for a work or school account opens.
- Do not type your email address in the main box. Typing it there adds a work or school account instead of joining the PC. Instead, under Alternate Actions, select Join this device to Microsoft Entra ID. On some Windows versions the link reads Join this device to Azure Active Directory.
- On the Let’s get you signed in screen, type your work or school email address, and then select Next.
- Type your password, and then select Sign in. The page may show your organization’s branding, or it may send you to your organization’s own sign-in page.
- If you are asked, approve the sign-in on your phone or complete the other verification your organization uses.
- On the Make sure this is your organization screen, check that the organization shown is correct, and then select Join.
- On the You’re all set screen, select Done.
- Sign out of your current account, and then sign in to Windows with your work or school email address and password.
Join during first-time setup of a new PC
A new or freshly reset PC can be joined while Windows is being set up, so no personal or local account is needed first. The device might restart several times and must stay connected to the internet.
- Turn on the PC and follow the setup prompts until Windows asks how you want to set up the device.
- When you see How would you like to set up this device?, select Set up for work or school.
- On the Let’s set things up for your work or school page, enter the credentials your organization gave you. That can be a username and password or another method such as a passkey.
- Keep following the prompts. Windows registers the PC in your organization’s directory and, if your organization requires it, enrolls it in device management.
- Finish setup. Depending on how your organization’s sign-in works, Windows either takes you straight to the desktop or shows the sign-in screen for you to enter your credentials.
Confirm the join worked
Open Settings > Accounts > Access work or school. A joined PC shows text similar to Connected to (your organization) Entra ID. If your organization uses device management, selecting the connection also shows an Info button that lists the policies and apps your organization applied and lets you start a sync.
For a more detailed check, open a command prompt while signed in with your work account and run dsregcmd /status. Look at the Device State section:
- AzureAdJoined : YES with DomainJoined : NO means the PC is Microsoft Entra joined.
- AzureAdJoined : YES with DomainJoined : YES means it is Microsoft Entra hybrid joined, which is set up by an organization, not by these steps.
- AzureAdPrt : YES further down means a Primary Refresh Token is present for the signed-in user. That token is what provides single sign-on to work apps.
What changes after joining
- Administrator rights: By default, the person who performs the join is added to the PC’s local Administrators group, along with your organization’s administrators. Your organization can turn this off.
- Management: If your organization has automatic enrollment configured, the PC is enrolled in MDM during the join. Policies and apps then arrive on their own.
- Other coworkers: Other people in your organization can sign in with their own work accounts. To make one of them an administrator on this PC, go to Settings > Accounts > Other users, select Add a work or school user, enter their account, and choose Administrator under Account type.
How to undo an Azure AD join
Warning: After the PC is disconnected you cannot sign in with any work or school account. Make sure you have a local administrator account, or create one, before you start. Disconnecting might also result in the loss of data on the device, so back up your files first.
- Open Settings > Accounts > Access work or school.
- Select your organization’s connection, and then select Disconnect.
- Follow the prompts and enter the local administrator account’s credentials when asked.
- Restart the PC to finish.
If you only added a work account to a personal PC, remove the work or school account from Windows 11 instead.
Troubleshooting
The join link is missing
The option is not available on Windows Home, and it does not work when you are signed in with a standard (non-administrator) account. A join also cannot be completed when the PC is already joined to an Active Directory domain or already connected to a work or school account. Remove the existing connection first, or ask your IT department which connection the PC should have.
“Oops… an error occurred!” appears
This happens when the organization has set up automatic Intune enrollment but the person joining does not have the right Intune license. Only your administrator can fix this by assigning the license.
The join fails with no error message
The likely cause is that you are signed in with the local built-in administrator account. Create a different local administrator account, sign in with it, and try again.
“Username or password is incorrect” right after joining
There are three common reasons: the credentials are no longer valid, the PC cannot reach Microsoft Entra ID because of a network problem, or you were given a temporary password that must be changed first. Check the internet connection and confirm your password with your IT department.
You are blocked from joining
Your organization can restrict who may join devices and can require multifactor authentication for a join. There is also a limit on devices per person, which defaults to 50. If you have reached it or are not on the allowed list, an administrator has to remove old devices or grant permission.
“Your organization has deleted the device” or “disabled the device”
These messages appear when someone deleted or disabled the PC’s record in Microsoft Entra ID. You may still reach the desktop with your saved sign-in, but work resources protected by device rules will not open. Contact your administrator.
The Disconnect button does not remove the connection
Organizations can apply a policy that prevents people from removing a management enrollment themselves. In that case only your IT department can release the PC.
Frequently asked questions
Is Azure AD join the same as Microsoft Entra join?
Yes. Azure Active Directory was renamed Microsoft Entra ID, and the join works the same way. Tools such as dsregcmd still print the old name in fields like AzureAdJoined.
Can I Azure AD join Windows 11 Home?
No. Microsoft Entra join is not supported on Home editions. You can register a Home PC by adding a work or school account, or upgrade the PC to Windows 11 Pro.
Should I join my personal PC?
Usually not. Joining is meant for organization-owned devices and registration for bring-your-own devices. Registration lets you keep signing in with your own account while still reaching work resources.
Can I sign in without an internet connection after joining?
Yes, if you have signed in on that PC before. Windows keeps a cached sign-in so that returning users can reach the desktop without a network connection.
Can a guest account from another organization sign in to a joined PC?
No. Guest users currently cannot sign in to a Microsoft Entra joined device.
How many work accounts can I add on one PC?
Windows limits a device to three Microsoft Entra accounts in one user session. After that, Windows shows an error that the account limit has been reached.
Microsoft’s official walkthrough is Join your work device to your work or school network, and the setup route has its own Microsoft Learn article on joining a new Windows 11 device during setup. Once the PC shows as connected, sign in with your work account and check with your IT department that it appears in their device list.
Matt Jacobs has been working as an IT consultant for small businesses since receiving his Master’s degree in 2003. While he still does some consulting work, his primary focus now is on creating technology support content for SupportYourTech.com.
His work can be found on many websites and focuses on topics such as Microsoft Office, Apple devices, Android devices, Photoshop, and more.