Does Microsoft Entra ID authentication create duplicate users during Hexnode enrollment?Solved

Microsoft Entra ID integration in Hexnode does not create duplicate user accounts during enrollment. When Entra ID is configured as the authentication source, Hexnode syncs the existing users from Entra ID and makes them available under Manage > Users. These synced users can then be used for device assignment and enrollment authentication.

A few key points:

• Entra ID integration does not create new users in Entra ID.
• Signing in with an Entra ID user during enrollment does not create duplicate Hexnode user records. –
• The synced Entra ID user is used to associate the enrolled device with that user.
• Entra ID authentication is separate from local account creation on the device. For your IT local admin account, that should be created separately.

After the device is enrolled, you can create a local account from Hexnode by going to Manage > Devices > select the device > Local Accounts, then creating the required local account.

So if we sync Entra ID, all Entra users may appear in Hexnode under users, but that doesn’t mean accounts are being created on the Macs or Windows devices, right?

Correct. Syncing Entra ID users into Hexnode only makes those directory users available for management, assignment, and enrollment authentication. It does not automatically create OS-level user accounts on macOS or Windows devices. The Entra ID user record in Hexnode and the local account on the endpoint are separate concepts. If you need a local admin or standard account on the device, create it separately through the device’s Local Accounts section in Hexnode.

Can Entra ID provisioning be added directly inside an enrollment profile so the admin account is created first and then the end user signs in?

No. Entra ID provisioning cannot be embedded inside a Hexnode enrollment profile for creating local accounts. The recommended approach is:

1. Integrate Microsoft Entra ID with Hexnode.
2. Sync the Entra ID users into Hexnode.
3. Use the synced user for device assignment or enrollment authentication.
4. Create any required local admin or standard account separately from Manage > Devices > select the device > Local Accounts.

In short, Entra ID authentication is reliable for using existing directory users during enrollment, but it is not an account provisioning workflow for creating local admin accounts on the device.