Device Management and Inviting Guest Users in Microsoft Entra ID
Sixth in this series on Microsoft Entra ID, covering how identities get extended to two kinds of "not quite a standard internal user" scenarios: devices, and external guest users.
Device management
Device identity types
Microsoft Entra ID supports three device identity types, and the right one depends on ownership (personal vs. corporate), OS, and whether the device needs access to on-premises resources.
| Type | Typical scenario | Ownership | How the user signs in |
|---|---|---|---|
| Microsoft Entra registered | BYOD / mobile — personal device accessing org resources | User-owned or org-owned | Local credentials (personal Microsoft account, local password) — not the work/school account, for the device itself |
| Microsoft Entra joined | Corporate-owned, cloud-only or cloud-first, no dependency on on-premises AD | Org-owned | The organisational work or school account |
| Microsoft Entra hybrid joined | Org has existing on-premises AD and wants to keep tools like Group Policy while also using Entra ID | Org-owned | Device joins the on-premises AD domain and is simultaneously registered with Entra ID; the user authenticates with an identity that exists in both |
Device write-back
Device write-back copies device objects into the "Registered Devices" container in on-premises Active Directory, which lets you apply on-premises conditional access to devices that are only registered in Microsoft Entra ID. It's what makes conditional access based on device status possible for applications integrated with AD FS, and it's a requirement for Windows Hello for Business (WHFB) in hybrid or federated scenarios.
Two details worth tightening from the original note: it requires AD FS 2012 R2 or higher (not just "2012"), plus claim rules to verify device status, and the forest holding the devices needs its schema upgraded to the Windows Server 2012 R2 level. It also requires a Microsoft Entra ID P1 or P2 licence — a detail the original note left out, and one worth knowing before assuming this is available on Free. (Device write-back also comes up alongside password write-back in the hybrid identity post later in this series, in the context of Microsoft Entra Connect's broader sync feature set.)
Inviting guest users
B2B collaboration and UPNs
A guest user is an external user granted access to an organisation's resources without being a full member of its directory — the mechanism for collaborating with partners, vendors, and contractors without provisioning them as full users. Microsoft Entra ID handles this through B2B collaboration, which simplifies granting access while keeping it controlled, and guest users can be assigned roles and permissions, including security group membership, through the same RBAC mechanisms as internal users — which is what actually limits them to only the resources they need.
You can restrict who can be invited as a guest by configuring collaboration restrictions and specifying allowed domains (fabrikam.com, for example) — invitations then only succeed for users from that domain. It's worth distinguishing this from guest user access restrictions under external collaboration settings, which is a separate control governing what guests can do once they're already in the tenant, not who gets invited in the first place — an easy pair to mix up.
Guest users get a distinctive UPN: it's the guest's email address (bsmith_contoso.com, using an underscore in place of the @) followed by #EXT#, followed by the resource tenant's domain (@fabrikam.com). A regular internal user, by contrast, has a UPN in the plain user@fabrikam.com form. More generally, a UPN is an internet-style login name in prefix@suffix format — the prefix is the account name, the suffix a domain. In a hybrid environment, the UPN is the primary sign-in identifier for cloud services, and a UPN mismatch — where the on-premises AD UPN doesn't match the one in Entra ID — usually comes from the on-premises AD using a non-routable domain suffix (like .local), an unverified UPN suffix in Entra ID, or a synchronisation error. Fixing it means making sure the on-premises UPN suffix is a verified domain in Microsoft Entra ID and updating accounts to use it.
Lab walkthrough
- Initiate the invitation — start the process of inviting an external user, specifying their email and the invitation details.
- Enter the guest's email address — this is the primary identifier used to send the invitation.
- Customise the invitation message — add context so the guest understands why they're being invited (for example, naming the project it relates to).
- Assign a role — grants the guest specific permissions, so they can do their job without over-provisioning access.
- Configure the user's location — matters for licensing and other organisational/compliance purposes.
- Send the invitation — triggers the email the guest uses to accept and start collaborating.
Troubleshooting
If an invitation isn't received, double-check the email address and make sure the guest's provider isn't blocking mail from Azure — spam and junk folders are the first place to look. If a guest can't access resources after accepting, verify the role and permissions assigned, and confirm the invitation was actually accepted and the account is active. And don't forget guest users are subject to the same conditional access policies as internal users — a policy that's inadvertently too strict will block guests exactly the same way it blocks employees (Conditional Access itself is covered in its own post later in this series).