UEM Bridge Cloud Join: move Windows PCs to Entra ID join without a reinstall
Part of UEM Bridge for Windows. Cloud Join moves hybrid-joined PCs to cloud-only Microsoft Entra ID join while keeping each person's files and settings, so you can drop the dependency on your domain without resetting every PC.
- For
- Companies moving Windows PCs from hybrid join to Microsoft Entra ID join
- Works with
- Active Directory, Microsoft Entra ID, Microsoft Intune, Windows 10 and 11
- Price
- $3 per device, one-time licence
See it in action
A short walkthrough of the tool on a real device.
Why hybrid join is hard to leave
Hybrid-joined PCs are registered with both your on-premises Active Directory and Microsoft Entra ID. Moving to cloud-only Entra ID join removes the need for domain controllers and VPN at sign-in.
Microsoft does not offer an in-place conversion. The standard route is to reset or reinstall each PC, which costs every person a day of setup.
Cloud Join feature matrix
Built as a native C#/.NET WPF execution engine, UEM Bridge Cloud Join handles every stage of moving Windows 10 and 11 PCs from Active Directory or Hybrid Join to cloud-native Microsoft Entra ID and Intune.
| Stage / Module | What Cloud Join does on each Windows PC | User & IT Outcome |
|---|---|---|
| 1. Pre-flight Readiness Check | Validates Windows 10/11 build, TPM 2.0 health, free disk space, AC power, Entra ID/Intune reachability, and pending reboot flags before starting. | Blocks unsafe cutovers before any domain change happens. |
| 2. Profile & Data Preservation | Snapshots local user profile paths, desktop files, browser state, app data, and maps ACL/SID permissions from the on-prem AD user to the target Entra ID user. | Zero data loss; the user signs back into their familiar desktop without a wipe. |
| 3. BitLocker & Key Escrow | Safely suspends BitLocker protection during the reboot window, re-enables protection post-join, and escrows recovery keys directly to Microsoft Entra ID and Intune. | No BitLocker recovery lockouts during domain leave or reboot. |
| 4. Clean Domain Unjoin & Agent Cleanup | Unjoins on-premises Active Directory cleanly, clears stale Group Policy registry tattoos, and removes legacy SCCM/co-management blockers. | Eliminates hybrid policy conflicts so Intune policies apply cleanly. |
| 5. Automated Entra ID & Intune Join | Applies bulk provisioning tokens (.ppkg) / enrollment tasks to join Microsoft Entra ID and trigger automatic Microsoft Intune MDM enrollment. | Device immediately receives Conditional Access, compliance policies, and apps. |
| 6. Native WPF Guided UI & Audit Logs | Shows the employee a clear step-by-step progress window with automatic reboot handling and writes structured transcript logs + Event Viewer telemetry. | Full audit trail for IT with minimal helpdesk tickets. |
How a rollout works
Prepare
Check Entra ID, Intune and licences are ready for cloud-only devices.
Pilot
Move a few PCs and confirm sign-in, files and apps.
Migrate
Move teams in scheduled batches.
Tidy up
Remove old computer objects and Group Policy dependencies.
Pricing
Prices are in US dollars and exclude applicable taxes.
$3
per device, one-time licence
You pay once for each device you move. Book a demo first to see the tool on one of your own devices.
Related services
Prefer us to run the whole migration for you? These services cover it end to end.
Want to try it on your devices?
Book a demo and we will run the tool with you on a test device.