← All posts
Security Research ·2026-07-15 ·7 min read

Entra ID joined does not mean secure: what to check on modern Windows fleets

More and more SMB fleets are Microsoft Entra ID (Azure AD) joined rather than joined to a traditional on-prem Active Directory domain. That is a good thing — it is the modern-workplace model. But it quietly breaks a lot of assessment tooling, and it changes which controls matter.

The reporting trap

Most posture tools check Win32_ComputerSystem.PartOfDomain to decide if a device is "managed". On an Entra-joined laptop that returns false — so the device gets flagged as a standalone workgroup machine, or worse, as unmanaged. It is neither. It is cloud-managed, just not AD-joined.

If your reports show "Domain: No" across a fleet of perfectly well-managed Intune devices, your tool is checking the wrong thing. The correct signal is dsregcmd /statusAzureAdJoined: YES. Argus 1.2.4 reads exactly this and labels each device as AD-domain, Entra ID, or standalone — so a modern fleet stops looking like a room full of rogue machines.

What actually matters on an Entra fleet

Domain group policy is not doing the hardening here — Intune and Entra Conditional Access are. So the endpoint checks that carry the most weight are the ones that survive without GPO:

  • BitLocker with a TPM + PIN or at least TPM-only, and the recovery key escrowed to Entra.
  • Local administrator hygiene — Entra-joined devices still have local admins. Password reuse across them is a classic lateral-movement path (Windows LAPS solves it; most fleets have not deployed it).
  • Defender / EDR state — tamper protection on, real-time on, cloud-delivered protection on.
  • Attack-surface-reduction rules and controlled folder access, which Intune can push but frequently is not.
  • SMBv1, LLMNR, and legacy protocol exposure — these do not disappear just because the device is cloud-joined.

The cross-device angle

One of the highest-value issues on a cloud-joined fleet is local-admin password reuse. Entra join does not give every device a unique local admin password; that is what Windows LAPS is for. When the same local Administrator password is set on many machines, one compromised laptop becomes all of them — the classic lateral-movement path. It is worth auditing for directly, and deploying Windows LAPS to eliminate. (Argus detects the shared account side of this today: a non-built-in local admin present on two or more of a client’s Windows devices, from the Administrators-group inventory the agent already collects — no hashes, no credential material. Opt-in per organisation. It does not compare passwords.)

Modern workplace is more secure by default than the old domain model — but "by default" is doing a lot of work in that sentence. Scan the fleet, read it as Entra rather than workgroup, and fix the handful of controls that Intune did not.

See your own clients' security posture in minutes.

Request a trial →