Domain checks in Trust Profile

Checks the computer’s role with respect to an Active Directory domain:

Unlike the other Active Directory checks, this one answers on every Windows computer, because a computer outside a domain still has a role. Use it to require domain membership, for example equals MemberWorkstation.

Compares the DNS name of the Active Directory domain the computer is joined to, for example corp.example.com. The comparison is not case sensitive.

This is the usual way to require joined to our domain.

Compares the short (NetBIOS) name of the domain. This is the part before the backslash in CORP\username. The comparison is not case sensitive.

Compares the unique identifier of the domain. A domain can be renamed but its GUID never changes, so this is the most precise way to identify our domain.

Enter the GUID without braces. To find it, run (Get-ADDomain).ObjectGUID in PowerShell on a computer with the Active Directory PowerShell module installed.

To require company-owned devices, use equals Device.

Checks that the computer is joined to a specific Entra ID tenant. This is a strict check. Computers that are only registered (join type Workplace) fail it, even when the account on them belongs to your tenant.

You can find your Tenant ID in the Microsoft Entra admin center under Overview. On a computer, run dsregcmd /status and look for TenantId.

Checks whether the Mac is enrolled in an MDM. Type one of these two values:

To require MDM-managed Macs, use equals MDMManaged.

MDMManaged covers every kind of MDM enrollment, including a user-approved enrollment that the user can remove.