You are here: Home > Device Management > Windows > Enrollment > Enroll Entra ID-Joined Devices

Enroll Windows Devices Already Joined to Entra ID

Enroll Windows PCs that were joined to Microsoft Entra ID before Applivery was configured — no unjoin or reset needed, using dsregcmd /forcerecovery.

3 min read

TL;DR

Devices joined to Entra ID before Applivery was configured don't enroll on their own. Run dsregcmd /forcerecovery, have the user sign in, and Windows refreshes its token and enrolls the device automatically.

When you set up the Microsoft Entra ID integration, any device joined to Entra ID from that point on enrolls into Applivery automatically. But devices that were already joined to Entra ID before you configured Applivery behave differently: they never show up for enrollment.

The reason is timing. These PCs are using a security token that was issued before the Applivery integration existed, so as far as the device knows, Applivery isn't there. The device isn't broken and nothing is misconfigured — it simply needs to refresh its token so it can discover the new MDM.

Microsoft provides a command for exactly this situation. Running dsregcmd /forcerecovery refreshes the device's registration with Entra ID without unjoining the machine or wiping any data. Once the token is refreshed, the device sees Applivery and enrolls on its own.

Note

This procedure assumes the Entra ID integration is already configured in your tenant. If it isn't, set that up first — otherwise the refreshed token still won't find Applivery.

1
Run the recovery command

You can trigger the token refresh in two ways. Choose whichever fits how you reach the affected devices.

Option A — Remotely, with an Applivery script

If the devices are already reachable in your Applivery Dashboard, push the command as a script. Go to Resources > Scripts, create a new PowerShell script with the line below, and assign it to the affected devices. See Scripts for the full flow.

dsregcmd /forcerecovery

Option B — Manually, on the device

On the PC, open a Command Prompt or PowerShell as administrator and run:

dsregcmd /forcerecovery
2
Sign in when prompted

When the command runs, the user sees a native Microsoft sign-in prompt. Have them sign in with their corporate Entra ID account.

This is the step that refreshes the device's security token — once the user signs in, Windows updates the token behind the scenes.

3
Let enrollment complete

After sign-in, Windows discovers Applivery as the MDM and automatically enrolls the device in the background. There's nothing else the user needs to do.

Once enrollment finishes, the device appears under Devices in the Applivery Dashboard with your organization's policies and apps applied.

Key Takeaways

  • Devices joined to Entra ID before Applivery was configured don't enroll automatically.
  • The cause is an outdated security token that predates the integration.
  • `dsregcmd /forcerecovery` refreshes the token without unjoining or resetting.
  • The command can be pushed remotely as an Applivery script or run manually.
  • After the user signs in, enrollment completes automatically in the background.

Because they were joined to Entra ID before Applivery was configured in your tenant. Their security token was issued before the integration existed, so it doesn't know Applivery is the MDM.

Run `dsregcmd /forcerecovery` on the device, either through an Applivery script or as an admin command. It refreshes the device's security token so it discovers Applivery.

No. `dsregcmd /forcerecovery` refreshes the security token without unjoining the machine from Entra ID or wiping any data.

A native Microsoft sign-in prompt. Once they sign in, Windows refreshes the token, discovers Applivery, and enrolls the device in the background.

Yes. Create a script containing `dsregcmd /forcerecovery` in Resources > Scripts and assign it to the affected devices, just like any other Windows script.

Yes. Applivery must already be integrated with your Entra ID tenant before running the command, otherwise the refreshed token still won't find Applivery.

Windows refreshes its security token, discovers Applivery as the MDM, and automatically enrolls the device in the background — no further action needed.

No. Devices joined to Entra ID after Applivery is configured enroll automatically. This procedure is only for devices that were joined before the integration.

Was this page helpful?

Last updated: July 14, 2026