Your network includes an on-premises AD DS domain synced to the contoso.com Microsoft Entra tenant. You must deploy 100 Windows 11 devices to contoso.com while ensuring users can access on-premises file shares without credential prompts and minimizing dependence on on-premises identity infrastructure. Which join type should you choose?

Microsoft Entra joined is the correct choice because it allows devices to be directly joined to Microsoft Entra ID, fulfilling the requirement to minimize dependence on on-premises identity infrastructure. Users can still access on-premises file shares without credential prompts through a single sign-on (SSO) experience using a Microsoft Entra Kerberos ticket, which is automatically issued when accessing on-premises resources. Active Directory domain-joined is incorrect because it relies entirely on the on-premises AD DS, which contradicts the goal of minimizing dependence on on-premises identity infrastructure. Microsoft Entra hybrid joined maintains a dependency on the on-premises AD DS for the primary device join, even though it also registers with Microsoft Entra ID. Microsoft Entra registered is incorrect because it’s primarily for personal devices (BYOD) and does not provide the same level of centralized management or SSO capabilities for on-premises resources as Microsoft Entra joined devices.