Device Registration & Join Settings
The question it answers: Who may join and register devices, does it need MFA, and who becomes local administrator on joined devices?
Who may join devices, whether that needs MFA, and who becomes local administrator on every joined device are tenant-wide settings nobody looks at after day one. The defaults let every user join devices and make them local admins.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Identity Configuration › Device Registration & Join |
| Workload | Entra ID |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | No extra licence needed. |
| Report id (API and MCP) | entra.configuration.device-registration-policy |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Area | Category | Text |
| Setting | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Detail | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Policy.Read.DeviceConfiguration | Microsoft Graph | Read your organization’s device configuration policies | |
Policy.Read.All | Microsoft Graph | Read your organization’s policies |
Data sources it reads
GET /v1.0/policies/deviceRegistrationPolicyGET /v1.0/identity/conditionalAccess/policies (cached)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.configuration.device-registration-policy?size=100An AI assistant reads it with the MCP tool get_report and the id entra.configuration.device-registration-policy. The client needs the Read grant for Entra ID. See Using the API.