How do we move devices from hybrid joined to Entra joined?

Key facts

• Moving to Entra join requires leaving the domain, which in practice means a reset and Autopilot.
• Entra joined devices can still use on-premises resources with Kerberos SSO when they can reach a domain controller.
• Known Folder Move in OneDrive protects desktop and documents before the reset.
• Group Policy does not apply to Entra joined devices, so Intune must cover required settings first.
• Hardware refresh is the cheapest time to move a device.

Why move at all

Hybrid Entra join was a bridge: devices stay domain joined while also registering in Entra ID. It works, but it keeps PCs dependent on domain controller connectivity, Group Policy and Entra Connect device sync, and it is a frequent source of sign-in and provisioning issues for remote staff.

Entra joined devices only need the internet. They get policy from Intune, sign in with Entra ID and Windows Hello for Business, and are a prerequisite for retiring Active Directory.

Prerequisites before any device moves

• OneDrive Known Folder Move enabled so Desktop, Documents and Pictures are in the cloud.
• Intune policies replacing the Group Policy settings that matter: security baselines, BitLocker, Defender, Windows Update, Wi-Fi and certificates.
• Apps packaged in Intune so they reinstall after reset.
• Windows Hello for Business configured, with cloud Kerberos trust if users need on-premises resources.
• Printers and mapped drives replaced or deployed via Intune.
• VPN or Entra Private Access for remote access to on-premises apps.
• Autopilot or Autopilot device preparation working for your hardware models.

Keeping access to on-premises resources

A common worry is that Entra joined PCs cannot reach file servers or internal apps. In practice, when users are synced from AD and the device can reach a domain controller, Entra joined devices get Kerberos tickets and single sign-on to on-premises file shares and Windows-authenticated apps.

Test every critical on-premises dependency with a pilot device before waves begin: file shares, line-of-business apps, printers, scanners, and anything that uses the computer account rather than the user account. Apps that require the computer itself to be domain joined are the main blockers and need a plan of their own.

The wave plan

The reset itself

• Confirm OneDrive sync is complete and nothing important is stored outside known folders.
• Remove the device from the domain and delete its old Entra ID and Intune records if needed, so Autopilot can claim it cleanly.
• Reset Windows using Intune, Windows settings or reimaging.
• The user signs in through Autopilot and gets policies and apps.
• Verify on-premises access, printing and line-of-business apps, then close the ticket.

How Accred Consulting approaches it

Accred Consulting starts with discovery of your device estate: join state, Group Policy dependencies, apps, OneDrive coverage and on-premises resources. The proposal sets prerequisites, waves, exceptions, a fixed price and a timeline. Our US-based specialists move required settings into Intune, configure Autopilot and Windows Hello for Business with cloud Kerberos trust, test on-premises access, and run the pilot and waves with check-ins after each. At handover you get the device runbook, exception list and documentation, with optional support for remaining waves.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions