More and more SMB fleets are Microsoft Entra ID (Azure AD) joined rather than joined to a traditional on-prem Active Directory domain. That is a good thing — it is the modern-workplace model. But it quietly breaks a lot of assessment tooling, and it changes which controls matter.
The reporting trap
Most posture tools check Win32_ComputerSystem.PartOfDomain to decide if a device is "managed". On an Entra-joined laptop that returns false — so the device gets flagged as a standalone workgroup machine, or worse, as unmanaged. It is neither. It is cloud-managed, just not AD-joined.
If your reports show "Domain: No" across a fleet of perfectly well-managed Intune devices, your tool is checking the wrong thing. The correct signal is dsregcmd /status → AzureAdJoined: YES. Argus 1.2.4 reads exactly this and labels each device as AD-domain, Entra ID, or standalone — so a modern fleet stops looking like a room full of rogue machines.
What actually matters on an Entra fleet
Domain group policy is not doing the hardening here — Intune and Entra Conditional Access are. So the endpoint checks that carry the most weight are the ones that survive without GPO:
- BitLocker with a TPM + PIN or at least TPM-only, and the recovery key escrowed to Entra.
- Local administrator hygiene — Entra-joined devices still have local admins. Password reuse across them is a classic lateral-movement path (Windows LAPS solves it; most fleets have not deployed it).
- Defender / EDR state — tamper protection on, real-time on, cloud-delivered protection on.
- Attack-surface-reduction rules and controlled folder access, which Intune can push but frequently is not.
- SMBv1, LLMNR, and legacy protocol exposure — these do not disappear just because the device is cloud-joined.
The cross-device angle
One of the highest-value issues on a cloud-joined fleet is local-admin password reuse. Entra join does not give every device a unique local admin password; that is what Windows LAPS is for. When the same local Administrator password is set on many machines, one compromised laptop becomes all of them — the classic lateral-movement path. It is worth auditing for directly, and deploying Windows LAPS to eliminate. (Argus detects the shared account side of this today: a non-built-in local admin present on two or more of a client’s Windows devices, from the Administrators-group inventory the agent already collects — no hashes, no credential material. Opt-in per organisation. It does not compare passwords.)
Modern workplace is more secure by default than the old domain model — but "by default" is doing a lot of work in that sentence. Scan the fleet, read it as Entra rather than workgroup, and fix the handful of controls that Intune did not.