Device identity is a credential in Entra: a registered or joined device gets a primary refresh token and can satisfy device-based conditional access. Creating a device identity you control, by registration, bulk-enrollment token, or hybrid-join forgery, yields a PRT and a trusted device, which unlocks SSO and policy-gated apps.
What folds in here#
- Device registration: registering a rogue device for a PRT.
- BPRT: bulk-enrollment provisioning tokens to register at scale.
- Hybrid join: forging a hybrid-joined device identity.