Do Hexnode-managed Macs count as Microsoft Entra hybrid joined for Conditional Access?Solved

Hello @everlycole ,

Hexnode’s Microsoft Entra Conditional Access integration does not make macOS devices Microsoft Entra hybrid joined.

When Hexnode UEM is configured as a compliance partner in Entra ID, Hexnode reports the device compliance status to Entra. Entra can then use that compliance state to allow or block access through Conditional Access.

For Hexnode-managed Macs, the recommended approach is:

1. Update the Conditional Access policy to require the device to be marked as compliant, instead of relying only on Microsoft Entra join, hybrid join, or ownership conditions.
2. Ensure the Mac is registered with Microsoft Entra ID. This is typically done through Microsoft Company Portal or Microsoft Authenticator during the user/device setup flow.
3. Once the Mac is registered and managed by Hexnode UEM, Hexnode can sync the compliance status to Entra ID.
4. If the Mac meets the compliance requirements configured in Hexnode, Entra can use that status to satisfy the Conditional Access policy.

So, the policy should be adjusted to evaluate device compliance reported by Hexnode UEM rather than expecting the Mac to appear as Microsoft Entra hybrid joined.

Regards,
Simon Scott
Hexnode UEM

We ran into the same thing while testing Macs. The important bit was making sure the devices were registered in Entra first. After that, the compliance state from Hexnode was what Conditional Access evaluated.