> For the complete documentation index, see [llms.txt](https://docs.jianny.net/work/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.jianny.net/work/azure/aad-device-pending.md).

# AAD Device Pending

<https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/pending-devices>

```
Hi Site IT team,

Device management is outside IAM scope -- We can support identity checks and log review, and often involved in similar investigations/diagnostics, but the Global Client Services (GCS) team managing Intune/SCCM is the appropriate owner for device registration troubleshooting and escalation to Microsoft Support when necessary

For this case, the password reset likely exposed an existing issue rather than caused it. Microsoft apps attempted to refresh authentication, but the laptop could not complete device authentication because it was not successfully hybrid joined
---
Reference:
https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current
---
Before routing the ticket to GCS, please try the following:

[1] Connect the laptop to the company network or approved VPN with access to the domain controllers

[2] Confirm the user can sign in to Windows using the new password

[3] Open CMD as admin and run: dsregcmd /status

      Upload the full output here, especially:
            Diagnostic Data
            Previous Registration
            Error Phase
            Client ErrorCode
            Server Message

[4] Open Task Scheduler:

      Task Scheduler Library > Microsoft > Windows > Workplace Join
      Run Automatic-Device-Join, wait 30-60 minutes, then run:
      dsregcmd /status

      Expected result:
            AzureAdJoined : YES
            DomainJoined : YES

      Also confirm the MS-Organization-Access certificate appears under:
      Local Computer > Personal > Certificates

[5] If the device remains Pending, review the dsregcmd error before resetting the registration

      Only if the error confirms a stale or failed registration, run from elevated CMD:
      dsregcmd /leave

      Restart the laptop while connected to the company network or VPN, then run Automatic-Device-Join again
      Do not use dsregcmd /reset

[6] If the join still fails, route the ticket to GCS with:
      Full dsregcmd /status output
      User Device Registration event logs
      Device name and user UPN
      Error screenshot and timestamp

Reset or reimage the laptop only after GCS confirms the AD, Entra and device configuration has been reviewed
```

<figure><img src="/files/EcjYL2iozljPlcOmepAG" alt=""><figcaption><p>Check if all checks out fine, use /leave and restart device to rejoin, may take more than 8 hours</p></figcaption></figure>

{% hint style="info" %}
\#1 Capture the output from 'dsregcmd /status' on the cmd prompt and upload the result here

\#2 Unregister the device by doing 'dsregcmd /reset' command in an elevated cmd prompt (Run as admin), then restart the PC. Try again if Teams can log in after 9 - 12 hours.

\#3 **Task Scheduler Library > Microsoft > Windows > Workplace Join**, manually start the task "Automatic-Device-Join" then make sure certificates issued by “**MS-Organization-Access**” and “**MS-Organization-P2P-Access \[xxxx]**” have been created in the local machine Personal certificate store, reboot PC

![](/files/dvolllZtPL2WYeK3Jvj4)![](/files/UIqbkaTHNRooi1bIKRN1)

\#4 The Last resort is to reset/format this machine
{% endhint %}

{% embed url="<https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current#troubleshoot-join-failures>" %}
Step by Step Guide
{% endembed %}

{% embed url="<https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-device-dsregcmd>" %}
Information on the dsregcmd output
{% endembed %}

<figure><img src="/files/EzbrH06hutHO5TxQzPh5" alt=""><figcaption></figcaption></figure>

`Get-MgDevice -All -Filter "TrustType eq 'ServerAd'" | Where-Object{($`*`.ProfileType -ne "RegisteredDevice") -and (-not $`*`.AlternativeSecurityIds)} | select-object -Property AccountEnabled, Id, DeviceId, DisplayName, OperatingSystem, OperatingSystemVersion, TrustType | export-csv pendingdevicelist-summary.csv -NoTypeInformation`