How to Use the dsregcmd Command in Windows 11 to Audit Microsoft Entra ID Join State and SSO Status

In modern enterprise IT environments, Windows 11 endpoints rely on Microsoft Entra ID (formerly Azure Active Directory) to facilitate identity management, Conditional Access enforcement, and Single Sign-On (SSO) across Microsoft 365 services. When users encounter authentication loops, device compliance failures, or unexpected password prompts, system administrators must verify the device’s directory registration state. The primary native utility for this purpose is dsregcmd (Device Registration Command).

Executing dsregcmd /status provides an exhaustive diagnostic snapshot covering tenant associations, device certificate health, Primary Refresh Token (PRT) validity, and enterprise workplace join parameters.

Key Diagnostic Sections in dsregcmd Output

Running a full status audit outputs hundreds of lines organized into distinct diagnostic headers:

• Device State: Displays whether the endpoint is AzureAdJoined (cloud-native Entra ID join), DomainJoined (traditional on-premises Active Directory), or AzureAdPrt (Hybrid Entra ID join).
• Device Details: Lists the unique DeviceId, tenant ID, and device thumbprint used to correlate the hardware record in Microsoft Intune and the Entra admin center.
• SSO State: The most critical section for troubleshooting sign-in issues. Verifies whether an active AzureAdPrt (Primary Refresh Token) exists and confirms timestamp validity.
• Diagnostic Data: Details cryptographic certificate bindings and Trusted Platform Module (TPM) hardware key attestation.

Primary Command Flags and Options

The table below summarizes essential command invocations for dsregcmd in Windows 11:

Command Invocations	Context & Privilege	Operational Purpose
dsregcmd /status	Standard User	Displays full device and user identity status, tenant IDs, and SSO PRT parameters.
dsregcmd /leave	Elevated (Administrator)	Unjoins the device from Microsoft Entra ID and clears stored device certificates.
dsregcmd /join	Elevated (Administrator)	Forces the device registration service to initiate an immediate Entra ID join sequence.
dsregcmd /debug	Elevated (Administrator)	Outputs real-time debug tracing during join or status queries to isolate network timeouts.

Step-by-Step: Auditing Entra ID Status in Terminal

To inspect your device’s registration and SSO state, follow these steps:

1. Press Win + X and select Terminal (or Terminal as Administrator).
2. Execute the status query:

   dsregcmd /status

3. Inspect the Device State block at the top of the output:

   +----------------------------------------------------------------------+
   | Device State                                                         |
   +----------------------------------------------------------------------+
   
                AzureAdJoined : YES
             EnterpriseJoined : NO
                 DomainJoined : NO
                  DeviceName  : DESKTOP-ENTRA11

   If AzureAdJoined displays YES, the device is successfully enrolled in cloud directory services.

4. Scroll down to the SSO State section:

   +----------------------------------------------------------------------+
   | SSO State                                                            |
   +----------------------------------------------------------------------+
   
                   AzureAdPrt : YES
          AzureAdPrtAuthority : https://login.microsoftonline.com/your-tenant-id
         AcquirePrtDiagnostics: PRESENT
                  Previous Prt: YES

   A value of AzureAdPrt : YES confirms that Windows has obtained a Primary Refresh Token, enabling seamless SSO across Edge, Teams, and Outlook.

Troubleshooting Common Failure States

Missing PRT (AzureAdPrt : NO)

If AzureAdPrt is set to NO, users will be prompted repeatedly for credentials. Common causes include:

• TPM Malfunctions: Entra ID binds the PRT to the physical TPM 2.0 chip. If TPM keys are cleared or corrupted, the PRT cannot be cryptographically secured. Verify TPM health by running tpm.msc.
• Conditional Access Block: A compliance policy or multi-factor authentication (MFA) requirement may be blocking token issuance.
• Clock Skew: Ensure the Windows 11 system clock is accurately synchronised with public NTP servers.

Frequently Asked Questions

Does running dsregcmd /status require administrative privileges?

No. Standard users can execute dsregcmd /status to inspect their personal SSO state and device join parameters. However, administrative commands such as /leave or /join require an elevated prompt.

What is the difference between Workplace Joined and Azure AD Joined?

Workplace Joined (registered) indicates a personal BYOD device accessing corporate resources via an authenticated work account. Azure AD Joined indicates full corporate management where Windows logons are directly authenticated by Entra ID credentials.