Entra Registration Status for Hybrid Device on pending for many days, Affecting access to Apps.

Question

Entra Registration Status for Hybrid Device on pending for many days, Affecting access to Apps.

Boipelo Kgomo 0

Kindly assist: Entra registered status on 'pending' for days. Device is hybrid joined & appears on Entra with pending registration status. I've ran the command 'dsregcmd /leave' restarted and doesnt work. I've deleted the object on Entra and still does not register. I've disjoined and joined to the domain as well. This is affecting multiple computers.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-26T11:53:35.84+00:00
Hello Boipelo Kgomo,

This usually means the Hybrid Azure AD join isn’t finishing. The device shows up in Entra ID, but registration never completes, so it stays in “Pending.” Since this is happening on multiple machines, it’s likely something in the setup rather than the devices.

On one affected device, run:

dsregcmd /status

If AzureAdJoined = NO or DeviceAuthStatus is not SUCCESS, the join didn’t complete.

Check the Service Connection Point in on-prem AD (Device Registration Configuration). Make sure the Tenant ID and Tenant Name are correct. If this is off, devices won’t complete registration.

On the Azure AD Connect server, confirm Hybrid Azure AD Join is enabled and devices are syncing without errors. You can trigger a sync:

Start-ADSyncSyncCycle -PolicyType Delta

Also make sure devices can reach:

enterpriseregistration.windows.net

login.microsoftonline.com

device.login.microsoftonline.com

Finally, check Event Viewer on the device: Applications and Services Logs → Microsoft → Windows → User Device Registration → Admin This will show the exact failure.

In cases like this, it usually comes down to SCP configuration, sync issues, or network restrictions blocking the registration step.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-01T19:12:54.82+00:00

Hello Boipelo Kgomo,

Any update on this? Please confirm if you still have further queries on this.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-26T11:53:35.84+00:00

Hello Boipelo Kgomo,

This usually means the Hybrid Azure AD join isn’t finishing. The device shows up in Entra ID, but registration never completes, so it stays in “Pending.” Since this is happening on multiple machines, it’s likely something in the setup rather than the devices.

On one affected device, run:

dsregcmd /status

If AzureAdJoined = NO or DeviceAuthStatus is not SUCCESS, the join didn’t complete.

Check the Service Connection Point in on-prem AD (Device Registration Configuration). Make sure the Tenant ID and Tenant Name are correct. If this is off, devices won’t complete registration.

On the Azure AD Connect server, confirm Hybrid Azure AD Join is enabled and devices are syncing without errors. You can trigger a sync:

Start-ADSyncSyncCycle -PolicyType Delta

Also make sure devices can reach:

enterpriseregistration.windows.net

login.microsoftonline.com

device.login.microsoftonline.com

Finally, check Event Viewer on the device: Applications and Services Logs → Microsoft → Windows → User Device Registration → Admin This will show the exact failure.

In cases like this, it usually comes down to SCP configuration, sync issues, or network restrictions blocking the registration step.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-01T19:12:54.82+00:00

Hello Boipelo Kgomo,

Any update on this? Please confirm if you still have further queries on this.

Answer 1

Pending status for Microsoft Entra hybrid joined devices across multiple computers indicates the hybrid join registration is not completing, not just a single-device corruption issue.

Key points from the scenario and supported remediation steps:

Understand the “Pending” state

Pending applies only to Microsoft Entra hybrid joined devices.
It means the device object has synced from on-premises AD to Entra ID, but the device has not completed registration with the Microsoft Entra device registration service.
While in pending, the device cannot get a Primary Refresh Token (PRT) or satisfy device-based Conditional Access, which explains app access issues.

Common causes when devices stay pending

Device cannot reach the Microsoft Entra device registration service (network, proxy, firewall, TLS inspection, etc.).
Hybrid join configuration issues (SCP, Entra Connect sync scope, or AD FS configuration in federated environments).
Device object lifecycle issues (moved between OUs in/out of sync scope, deleted/recreated) causing the device to think it is already registered.

Scenario where devices get stuck in pending after OU moves If devices were moved between OUs that are and are not in Entra Connect sync scope, the following can happen:

Device moved to OU outside sync scope → Entra Connect treats it as deleted and deletes the Entra device.
Device moved back into sync scope → Entra Connect creates a new device object in Entra with state “pending”.
Device fails to complete registration because it was previously registered.

In that case, the supported fix is:

On the affected device, run dsregcmd /leave in an elevated command prompt.
Restart the device.
Allow the scheduled hybrid join task to run:
- Task Scheduler → Task Scheduler Library → Microsoft → Windows → Workplace Join → Automatic-Device-Join.

This is exactly what has already been attempted. If it still does not complete, the issue is likely environmental (connectivity or configuration) rather than the individual device.

Verify hybrid join state and registration On a sample affected device:

Run dsregcmd /status in an elevated PowerShell/Command Prompt.
Confirm:
- AzureAdJoined = YES
- DomainJoined = YES If AzureAdJoined is NO, hybrid join is not completing locally.
In the Microsoft Entra admin center:
- Entra ID → Devices → All devices.
- Check the device:
  - If Registered = Pending, hybrid join has not completed.
  - If Registered shows a date/time, hybrid join has completed.

Use the official troubleshooting tools Because this affects multiple devices, use the supported tools to identify the common root cause:

Device Registration Troubleshooter Tool / Device Registration Troubleshooter (DevRegTS / dsregtool) to check:
- Device health status (Pending).
- PRT issuance.
Hybrid join troubleshooting guidance for Windows 10/11 and Windows Server 2016+ to validate:
- SCP configuration.
- Entra Connect sync configuration and scope.
- Federation/AD FS configuration if applicable.

Check for known “stuck pending” conditions From the documented scenarios, focus on:

OU / sync-scope changes:
- Ensure device objects are in OUs that are in Entra Connect sync scope and remain there.
- Avoid moving device objects in and out of scope.
AD FS environments:
- Ensure client-side SCP is configured correctly on AD FS servers so that Microsoft Entra ID is the source of authority for device objects.
- If client-side SCP is not configured, AD FS may delete device objects from on-premises after MaximumInactiveDays, causing churn and registration issues.

When dsregcmd /leave + reboot does not help If the documented fix (dsregcmd /leave + restart + automatic device join task) does not resolve the issue on multiple devices, the next steps are:

Validate hybrid join configuration end-to-end using the hybrid join troubleshooting article.
Run the Device Registration Troubleshooter Tool on at least one affected device and follow its findings (for example, connectivity to device registration endpoints, policy misconfiguration, or token issues).
Confirm that Entra Connect is healthy and successfully syncing device objects, and that there are no errors related to device sync.

Because the issue is multi-device and persists after local cleanup, the resolution will almost certainly come from correcting the hybrid join / device registration configuration or connectivity, not from further deleting/rejoining individual devices.

References: