Entra Hybrid Join + Intune Enrollment Issue

Duplicate entries in Microsoft Entra ID for hybrid-joined devices enrolled into Intune are expected in several scenarios and cannot be merged.

From the provided information, there are two closely related behaviors:

1. Duplicate device objects for the same Windows device
   • Duplicate entries can appear when:
     • A Windows 10/11 or Windows Server 2016+ device is unjoined and rejoined multiple times.
     • Multiple users use Add Work or School Account on the same device, each creating its own Microsoft Entra registered record.
     • A device is wiped/reimaged and rejoined with the same name.
   • Each of these actions creates a new device record with the same device name but a different device ID. There is no supported way to “merge” these device objects; they are separate registrations by design.
2. Hybrid-joined device plus a separate Entra registered record (dual state)
   • On a domain-joined device, when a user is prompted with Add account to Windows? and selects Yes, the device is registered as Microsoft Entra registered.
   • After Microsoft Entra hybrid join is enabled, the same device also becomes Microsoft Entra hybrid joined, resulting in two device states for the same physical device.
   • In most cases, the hybrid joined state takes precedence for authentication and Conditional Access, but the dual state can sometimes cause nondeterministic behavior and access issues.

What can be done

1. No merge capability
   • There is no supported mechanism to merge multiple Microsoft Entra device objects into one. Each registration/enrollment creates its own device object.
2. Avoid creating the extra Entra registered record
   • For hybrid-joined devices, avoid using Access work or school → Connect in a way that triggers the Add account to Windows? prompt and leads to a separate Microsoft Entra registered state.
   • Ensure users do not choose Yes to “Add account to Windows?” on already domain-joined, hybrid-join-managed devices unless that behavior is explicitly required.
3. Rely on the hybrid-joined object as the primary device identity
   • For hybrid-joined devices, the Microsoft Entra hybrid joined object is the primary identity used for device-based Conditional Access and SSO.
   • Where dual state exists (hybrid joined + registered), follow the guidance to avoid or clean up dual state on Windows 10/11 devices. The documentation notes that on Windows 10 version 1803 and above, the Microsoft Entra registered state is automatically cleaned up in many cases.
4. Understand and limit duplicate creation scenarios
   • Minimize repeated unjoin/rejoin cycles for the same device.
   • Limit the number of different users adding Work or school accounts on the same device when not needed.
   • When reimaging devices, expect a new device object even if the hostname is reused; plan lifecycle processes (e.g., periodic cleanup of stale device objects) accordingly.

There is no safer “merge” path; the supported approach is to:

• Prevent unnecessary additional registrations (especially via Access work or school on hybrid-joined devices), and
• Use the hybrid-joined device object as the authoritative identity while cleaning up stale/duplicate objects as part of normal device lifecycle management.

References:

• Microsoft Entra device management FAQ
• Microsoft Entra hybrid joined devices