# Enroll Devices Already Joined to Entra ID

> Enroll Windows PCs that were joined to Microsoft Entra ID before Applivery was configured — no unjoin or reset needed, using dsregcmd /forcerecovery.

Source: https://docs.applivery.com/en/device-management/windows/enrollment/entra-id-joined-devices-enrollment/  •  Last updated: 2026-07-14

**Key topics:** Entra ID-joined device enrollment, dsregcmd forcerecovery, Windows MDM enrollment, Applivery scripts, Security token refresh, Microsoft Entra ID, Applivery, Windows, MDM, dsregcmd

---

**TL;DR:** Devices joined to Entra ID before Applivery was configured don't enroll on their own. Run `dsregcmd /forcerecovery`, have the user sign in, and Windows refreshes its token and enrolls the device automatically.

When you set up the [Microsoft Entra ID integration](https://docs.applivery.com/en/device-management/windows/enrollment/entra-id-enrollment/), any device joined to Entra ID from that point on enrolls into Applivery automatically. But devices that were **already joined to Entra ID before** you configured Applivery behave differently: they never show up for enrollment.

The reason is timing. These PCs are using a security token that was issued _before_ the Applivery integration existed, so as far as the device knows, Applivery isn't there. The device isn't broken and nothing is misconfigured — it simply needs to refresh its token so it can discover the new MDM.

Microsoft provides a command for exactly this situation. Running `dsregcmd /forcerecovery` refreshes the device's registration with Entra ID **without unjoining the machine or wiping any data**. Once the token is refreshed, the device sees Applivery and enrolls on its own.

:::info
This procedure assumes the [Entra ID integration](https://docs.applivery.com/en/device-management/windows/enrollment/entra-id-enrollment/) is already configured in your tenant. If it isn't, set that up first — otherwise the refreshed token still won't find Applivery.
:::

**Run the recovery command**

You can trigger the token refresh in two ways. Choose whichever fits how you reach the affected devices.

**Option A — Remotely, with an Applivery script**

If the devices are already reachable in your Applivery Dashboard, push the command as a script. Go to **Resources > Scripts**, create a new PowerShell script with the line below, and assign it to the affected devices. See [Scripts](https://docs.applivery.com/en/device-management/windows/policies/scripts/) for the full flow.

```powershell
dsregcmd /forcerecovery
```

**Option B — Manually, on the device**

On the PC, open a Command Prompt or PowerShell **as administrator** and run:

```powershell
dsregcmd /forcerecovery
```

**Sign in when prompted**

When the command runs, the user sees a **native Microsoft sign-in prompt**. Have them sign in with their corporate Entra ID account.

This is the step that refreshes the device's security token — once the user signs in, Windows updates the token behind the scenes.

**Let enrollment complete**

After sign-in, Windows discovers Applivery as the MDM and **automatically enrolls the device in the background**. There's nothing else the user needs to do.

Once enrollment finishes, the device appears under **Devices** in the [Applivery Dashboard](https://dashboard.applivery.io/) with your organization's policies and apps applied.