Separate Defender synthetic device registration from full Entra join

Source facts

Security settings management creates a synthetic Entra device identity when the device has not fully registered, allowing it to retrieve security policy. These records can show MDM as Intune with a blank join type, and the synthetic registration counts as a device object. If a full registration is later created, the synthetic one is removed and management continues through the full registration. Microsoft Learn.

Applicability

Use this explanation when reconciling devices managed through Defender for Endpoint security settings management. Identify the management route before treating an unusual directory record as an enrollment failure.

DSE recommendation

DSE recommends recording the security-settings management route in inventory reconciliation rules. Have support distinguish a synthetic identity from an intended full join before proposing reenrollment or deletion. Map the record to its actual endpoint and confirm which policy assignments are expected through Defender.

Verification

Compare the same device across the Defender, Intune and Entra views using its identifiers and observed management state. Inspect policy receipt and status separately from the join field. If the device transitions to full registration, verify the resulting identity and continued intended policy management before closing a duplicate-record investigation.

Official references

Microsoft Learn: Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that are not enrolled with Intune. Source reviewed September 17, 2026.