Your on-premises network has an AD DS domain synchronized to a Microsoft Entra tenant. You want users to sign in to Microsoft 365 from their personal Windows devices using single sign-on while minimizing organizational control over those devices. Which device join type should you use?

Microsoft Entra registered devices are ideal for personal devices (BYOD) because they allow users to sign in with their organizational account to access company resources using single sign-on (SSO) while maintaining minimal organizational control. This option registers the device with Microsoft Entra ID without joining it to the domain, making it suitable for personal devices where full management is not desired. Microsoft Entra joined devices are typically for organization-owned devices that require full cloud-based management. Active Directory domain-joined devices are for on-premises domain-joined devices managed by Group Policy, which doesn't fit the BYOD scenario. Microsoft Entra hybrid joined devices are for organization-owned devices that are joined to an on-premises AD DS domain and also registered with Microsoft Entra ID, offering more control than desired for personal devices.