# Separate Defender synthetic device registration from full Entra join

> Why can a Defender-managed device appear in Entra and Intune without a full join record?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:30+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why can a Defender-managed device appear in Entra and Intune without a full join record?

## Potentially affected

Use this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.

## DSE recommendation

DSE recommends recording the security-settings management route in inventory reconciliation rules.

## Article

## Source facts

Security settings management creates a synthetic Entra device identity when the device has not fully registered, allowing it to retrieve security policy. These records can show MDM as Intune with a blank join type, and the synthetic registration counts as a device object. If a full registration is later created, the synthetic one is removed and management continues through the full registration. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management).

## Applicability

Use this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.

## DSE recommendation

DSE recommends recording the security-settings management route in inventory reconciliation rules. Have support distinguish a synthetic identity from an intended full join before proposing reenrollment or deletion. Map the record to its actual endpoint and confirm which policy assignments are expected through Defender.

## Verification

Compare the same device across the Defender, Intune and Entra views using its identifiers and observed management state. Inspect policy receipt and status separately from the join field. If the device transitions to full registration, verify the resulting identity and continued intended policy management before closing a duplicate-record investigation.

## Official references

[Microsoft Learn: Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune](https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management). Source reviewed September 17, 2026.

## Primary reference

- Name: Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-security/microsoft-defender/security-settings-management
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Defender synthetic device registration from full Entra join,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-090-separate-defender-synthetic-device-registration-from-full-entra-join/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.