A cloud-based identity and access management service for securing user authentication and resource access
Because the device was unregistered, it must be re-registered locally; cloud-side alone is not sufficient. The exact steps depend on how the device was joined to Microsoft Entra ID.
Since sign-in is currently blocked, these actions must be performed by someone who can sign in locally with sufficient rights (for example, a local admin account) or by an admin with physical access to the device.
- Determine the device join type
- If this is a corporate device, an admin can check the device object and join type in the Microsoft Entra admin center (Devices → All devices) before it was removed.
- Use the table in the “Error AADSTS700003 - Device object was not found” article to match the correct recovery steps.
- If the device was Microsoft Entra joined
- Sign in to Windows with a local administrator account.
- Open PowerShell or Command Prompt as administrator.
- Run:
dsregcmd /forcerecovery - When prompted, select Sign in and authenticate with the Microsoft Entra ID account.
- After the recovery completes, sign out and sign back in.
- If the device was Microsoft Entra hybrid joined
- Sign in with a local/domain account that has admin rights.
- Open PowerShell or Command Prompt as administrator.
- Run:
dsregcmd /leave - Reboot the device.
- Sign in with the on-premises domain credentials; this will trigger the scheduled task to re-register the device with Microsoft Entra ID.
- If the device was Microsoft Entra registered (work/school account on a personal device)
- Sign in with a local account that can access Windows.
- Go to Settings → Accounts → Access work or school.
- Select the work/school account and choose Disconnect.
- Then select + Connect and go through the sign-in process again to re-register the device.
- If the device object was disabled (not deleted) in Entra ID
- A Microsoft Entra administrator can re-enable the device in the Microsoft Entra admin center (Identity → Devices → All devices → select device → Enable).
- For hybrid-joined devices synced with Microsoft Entra Connect, the device will be automatically re-enabled on the next sync if it is enabled in on-premises AD.
If sign-in is still not possible after these steps, an admin should run dsregcmd /status (from an account that can log on) and use the Device Registration Troubleshooter Tool to verify device health and registration state.
References: