Entra Hybrid Join using Entra Kerberos

This new capability enables a Windows device to become Hybrid Entra joined immediately at provisioning time, without waiting for Entra Connect sync or requiring AD FS. By leveraging Entra Kerberos, customers can modernize their hybrid identity architecture while reducing infrastructure complexity and dependency on legacy federation components. For more information, see: Microsoft Entra hybrid join using Microsoft Entra Kerberos (preview).

Affected: Microsoft Entra ID, Device Registration and Management

Related changes

• Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows · Kerberos
• External users can be directly assigned to Access Packages · Microsoft Entra ID
• BYOD support for Windows client using Entra registration · Microsoft Entra ID
• Jailbreak/Root Detection in Authenticator App · Microsoft Entra ID
• Extended Conditional Access protections for Agent's user accounts · Microsoft Entra ID
• Domainless SAML IdP federation for workforce tenants · Microsoft Entra ID

View at Microsoft → Copy summary