Control device join and registration

Whether joining or registering a device needs MFA, who may do it, who becomes local administrator during device join, and whether Microsoft Entra allows Windows LAPS backups. These tenant settings do not prove endpoint deployment or compliance.

A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.