{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "slug": "dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join", "url": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/" }, "title": "Separate Defender synthetic device registration from full Entra join", "summary": "Why can a Defender-managed device appear in Entra and Intune without a full join record?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:30+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 219, "potentially_affected": "Use this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.", "dse_recommendation": "DSE recommends recording the security-settings management route in inventory reconciliation rules.", "primary_source": { "name": "Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Security settings management creates a synthetic Entra device identity when the device has not fully registered, allowing it to retrieve security policy. These records can show MDM as Intune with a blank join type, and the synthetic registration counts as a device object. If a full registration is later created, the synthetic one is removed and management continues through the full registration. Microsoft Learn.

\n

Applicability

\n

Use this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.

\n

DSE recommendation

\n

DSE recommends recording the security-settings management route in inventory reconciliation rules. Have support distinguish a synthetic identity from an intended full join before proposing reenrollment or deletion. Map the record to its actual endpoint and confirm which policy assignments are expected through Defender.

\n

Verification

\n

Compare the same device across the Defender, Intune and Entra views using its identifiers and observed management state. Inspect policy receipt and status separately from the join field. If the device transitions to full registration, verify the resulting identity and continued intended policy management before closing a duplicate-record investigation.

\n

Official references

\n

Microsoft Learn: Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune. Source reviewed September 17, 2026.

", "content_text": "Source facts\nSecurity settings management creates a synthetic Entra device identity when the device has not fully registered, allowing it to retrieve security policy. These records can show MDM as Intune with a blank join type, and the synthetic registration counts as a device object. If a full registration is later created, the synthetic one is removed and management continues through the full registration. Microsoft Learn.\nApplicability\nUse this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.\nDSE recommendation\nDSE recommends recording the security-settings management route in inventory reconciliation rules. Have support distinguish a synthetic identity from an intended full join before proposing reenrollment or deletion. Map the record to its actual endpoint and confirm which policy assignments are expected through Defender.\nVerification\nCompare the same device across the Defender, Intune and Entra views using its identifiers and observed management state. Inspect policy receipt and status separately from the join field. If the device transitions to full registration, verify the resulting identity and continued intended policy management before closing a duplicate-record investigation.\nOfficial references\nMicrosoft Learn: Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nSecurity settings management creates a synthetic Entra device identity when the device has not fully registered, allowing it to retrieve security policy. These records can show MDM as Intune with a blank join type, and the synthetic registration counts as a device object. If a full registration is later created, the synthetic one is removed and management continues through the full registration. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management).\n\n## Applicability\n\nUse this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.\n\n## DSE recommendation\n\nDSE recommends recording the security-settings management route in inventory reconciliation rules. Have support distinguish a synthetic identity from an intended full join before proposing reenrollment or deletion. Map the record to its actual endpoint and confirm which policy assignments are expected through Defender.\n\n## Verification\n\nCompare the same device across the Defender, Intune and Entra views using its identifiers and observed management state. Inspect policy receipt and status separately from the join field. If the device transitions to full registration, verify the resulting identity and continued intended policy management before closing a duplicate-record investigation.\n\n## Official references\n\n[Microsoft Learn: Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune](https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "url": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate Defender synthetic device registration from full Entra join", "item": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "url": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/", "headline": "Separate Defender synthetic device registration from full Entra join", "description": "Why can a Defender-managed device appear in Entra and Intune without a full join record?", "abstract": "Why can a Defender-managed device appear in Entra and Intune without a full join record?", "articleBody": "Source facts\nSecurity settings management creates a synthetic Entra device identity when the device has not fully registered, allowing it to retrieve security policy. These records can show MDM as Intune with a blank join type, and the synthetic registration counts as a device object. If a full registration is later created, the synthetic one is removed and management continues through the full registration. Microsoft Learn.\nApplicability\nUse this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.\nDSE recommendation\nDSE recommends recording the security-settings management route in inventory reconciliation rules. Have support distinguish a synthetic identity from an intended full join before proposing reenrollment or deletion. Map the record to its actual endpoint and confirm which policy assignments are expected through Defender.\nVerification\nCompare the same device across the Defender, Intune and Entra views using its identifiers and observed management state. Inspect policy receipt and status separately from the join field. If the device transitions to full registration, verify the resulting identity and continued intended policy management before closing a duplicate-record investigation.\nOfficial references\nMicrosoft Learn: Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:30+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Defender synthetic device registration from full Entra join" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 219, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management" } } ] } }