Lesson 1: The Device Service on One Page

Before we start: this course is independent

This course is not made, endorsed or reviewed by Microsoft. It is independent training written by practitioners for first and second line support staff. Microsoft renames products, moves menu items and changes limits often. Azure AD became Microsoft Entra ID, and Endpoint Manager became the Intune admin center. So every console path, number and screen in this course is dated, and you should check it against Microsoft's current documentation before you rely on it. When this course and the live console disagree, believe the console and the current docs. The paths and limits in this lesson were checked in November 2026.

The idea: four services behind one laptop

A user sees one laptop. Support needs to see four services stacked behind it. The ticket says "my laptop is broken". Your first job is to turn that into "this is an identity problem" or "this is a management problem". Getting that first step right saves most of the time on a ticket.

Think of a new starter's first day. Entra ID is the ID badge. Autopilot is the induction that hands them a desk ready to use. Intune is facilities, who checks the desk meets the rules and keeps it stocked. Microsoft 365 Apps is the software on the desk, and it only works while their subscription badge is valid.

The layers depend on each other in order. Autopilot uses Entra ID to join the device. Intune enrols the device as part of that join. Office activation relies on the user's Entra sign-in and licence. A fault low in the stack, such as a broken device identity, shows up as symptoms everywhere above it.

Worked example: reading the stack from the device

You can check the bottom layer from the user's own machine without changing anything. Open a normal Command Prompt (not elevated) as the signed-in user:

C:\> dsregcmd /status

+----------------------------------------------------------------------+
| Device State                                                         |
+----------------------------------------------------------------------+
             AzureAdJoined : YES     <- device is joined to Entra ID
          EnterpriseJoined : NO
              DomainJoined : NO      <- YES here as well = hybrid joined
...
          DeviceAuthStatus : SUCCESS <- device object exists and is enabled
...
                    MdmUrl : https://enrollment.manage.microsoft.com/...
                             ^ tenant has MDM auto-enrolment set up
                               (this does NOT prove this device is managed)
...
| SSO State                                                            |
                AzureAdPrt : YES     <- user holds a Primary Refresh Token,
                                        the basis of single sign-on

How to read it:

• AzureAdJoined : YES with DomainJoined : NO means a cloud-only Microsoft Entra joined device. That is what Autopilot device preparation produces.
• AzureAdPrt : NO for a signed-in user usually explains a run of password prompts in Outlook and Teams. That is an identity fault, so start in Entra ID.
• Gotcha: run it as the user. The user and SSO sections need the user's context, and an elevated prompt can report misleading values.

Next, the user-facing view of management: Settings > Accounts > Access work or school. A connected work account with an Info button means the device is enrolled in management. The Company Portal app shows the same thing from Intune's side, including whether the device is compliant.

Last, Office: in Word, go to File > Account. Under Product Information it shows who the product belongs to, or a sign-in or activation warning.

Which service do I look at first?

Match the symptom to the layer, then open that layer's console. Every console below opens in a browser, and for now you only read in them.

Symptom                                   -> Look first in
----------------------------------------------------------------------
Can't sign in / constant password prompts -> Microsoft Entra ID
  / "your organisation has disabled this     (entra.microsoft.com)
  device"
New device stuck on setup screens         -> Autopilot, viewed in Intune
                                             (intune.microsoft.com)
"Device not compliant", blocked from      -> Intune: Devices > All devices
  email, app missing from Company Portal     > [device] > Device compliance
Office says unlicensed / view-only        -> The user's licence first
  ("reduced functionality mode")             (admin.microsoft.com),
                                             then the Office install

Best practice: work from the bottom of the stack up. A device that isn't properly joined to Entra ID can't be compliant in Intune, and conditional access then blocks Office as a knock-on effect. Fix compliance first and you are fixing the wrong layer.

Two numbers worth knowing now

Microsoft's licensing overview (updated September 2026) states two limits that shape Office tickets:

• One Microsoft 365 Apps licence lets a user install on up to five desktops, five tablets and five mobile devices.
• An installation has to reach Microsoft's licensing service at least once every 30 days. If it doesn't, it drops into reduced functionality mode: the user can view and print but can't edit or create. The same happens straight away if their licence is removed.

So "Word won't let me type" after a long offline spell or a leaver-and-rehire is an activation or licence issue, not a broken install. Later levels show how to confirm this.

Trade-off to keep in mind: this map is simplified on purpose. Real tenants add hybrid join, conditional access and security agents. Treat the four-layer map as your first triage step, not a complete picture.

Key takeaways

• The user sees one device, and four services sit behind it: Entra ID (identity), Autopilot (setup), Intune (management, compliance, Company Portal) and Microsoft 365 Apps (Office and activation).
• Map the symptom to a layer before you touch anything, and work bottom-up: identity, then management, then apps.
• dsregcmd /status, run as the user, is a read-only first look at device join state and single sign-on health.
• Office that can view but not edit points to licence or activation (the 30-day check-in, or the licence being removed), not a broken install.
• This course is independent of Microsoft. Screens and limits change, so check each one against Microsoft's current documentation and note the date you checked.