Website under construction

Table 4-1:
Variations across different “join” methods 
Corporate device (joined to on-
premises domain) 
Corporate device (joined to the 
cloud) 
Personal device 
Users can sign in to Windows with 
work credentials (as they do 
today). 
Users can sign in to Windows with 
work credentials that are managed 
in Azure AD. This is relevant for 
corporate devices in three cases: 

The organization doesn’t have 
Active Directory on-premises 
(for example, a small business). 

The organization doesn’t 
create all user accounts in 
Active Directory (for example, 
accounts for students, 
consultants, or seasonal 
workers are not created in 
Active Directory). 

The organization has corporate 
devices that can’t be joined to 
an (on-premises) domain, like 
phones or tablets running a 
Mobile SKU (for example, a 
secondary device taken to a 
factory/retail floor). Azure AD 
Join supports joining of 
corporate devices for both 
managed and federated 
organizations. 
Users sign in to Windows 
with their personal 
Microsoft account 
credentials (no change). 
Users have access to roaming 
settings and the enterprise 
Windows Store. These services 
work with work accounts and 
don't require a personal Microsoft 
account. This requires 
organizations to connect their on-
premises Active Directory to 
Azure AD. 
Users can do self-service setup. 
They can go through the first-run 
experience (FRX) via their work 
account as an alternative to having 
IT provision the devices, although 
both methods are supported. 
Users can easily add a work 
account that’s managed in 
Active Directory or Azure 
AD. 
Users have SSO ability from the 
desktop to work apps, websites, 
and resources—including both 
on-premises resources and cloud 
apps that use Azure AD for 
authentication. 
Devices are automatically 
registered in the enterprise 
directory (Azure AD) and 
automatically enrolled in mobile 
device management. (Azure AD 
Premium feature). 
Users have SSO ability 
across apps and to 
websites/resources with 
this work account. 

---

128 
CHAPTER 4 | Security and identity 
Users can add their personal 
Microsoft accounts to access their 
personal pictures and files without 
affecting enterprise data. 
(Roaming settings continue to 
work with their work accounts.) 
The Microsoft account makes SSO 
possible and no longer drives the 
roaming of settings. 
Users can do a self-service 
password reset (SSPR) on 
winlogon, meaning they can reset 
a forgotten password. (Azure AD 
Premium feature). 
Users have access to the 
enterprise Windows Store 
so that they can acquire 
and use line-of-business 
apps on their personal 
devices.