What's new 
We have Microsoft Entra ID connected with Hexnode and use Conditional Access. Our iOS devices show as registered in Entra ID, Intune, and the Hexnode device summary, but users still get a Hexnode notification saying “Entra ID Registration” after each scheduled sync. Tapping the notification does not seem to do anything. The device is already registered, and the status in Hexnode looks successful. The issue seems to happen after our nightly Entra sync and affects multiple Entra-registered iOS users. Android devices do not appear to behave the same way. There is no separate Hexnode policy that we created for this. The Conditional Access configuration is syncing from Entra ID. Is there a way to stop these repeated registration prompts before rolling this out to more iOS devices?
33 Views
Replies (3)
This behavior can occur when the Entra ID registration workflow is re-evaluated during scheduled Conditional Access syncs. For affected devices, first verify the following in Hexnode:
- Go to Manage and open the affected device.
- Check the Azure Info or Entra registration section on the device summary.
- Confirm whether the Entra ID Registration Status shows as successful.
- Review the device Action History to see whether the registration or associate-device action is being triggered again during the scheduled sync.
- Confirm that the device owner in Hexnode is mapped to the correct Microsoft Entra ID user.
- Run a Scan Device action once to force the device to report its latest state back to Hexnode.
If this is happening only on iOS and the device already shows as registered, it is likely not a user-side registration issue. Routine Conditional Access policy re-evaluation should normally happen silently in the background and should not show an interactive registration prompt unless user action is required.
We checked that. The devices show as registered in Hexnode and Entra ID, and the owner mapping looks correct. A manual scan also completes, but the notification still appears again when the scheduled sync runs. Also, there is no Hexnode-created policy to remove and re-add. This is coming from the Conditional Access setup synced from Entra ID.
In that case, removing and re-targeting a Hexnode-native policy would not apply, since the assignment is coming from Microsoft Entra Conditional Access.
For this specific scenario, the cause was identified as an iOS notification handling issue during background Entra sync. Hexnode was re-evaluating the Conditional Access registration payload as expected, but iOS devices were receiving an active Entra ID Registration push notification even when the command status had not actually changed.
Expected behavior:
- Scheduled Entra/Conditional Access syncs may re-check policy and registration state.
- Already registered devices should process this silently.
- Users should only see a registration notification when an actual registration action is required.
A server-side update was released so that Hexnode sends the registration notification only when the device command status actively changes. After the update, routine nightly syncs should no longer re-trigger Entra ID Registration prompts on already registered iOS devices.
