Forum Discussion
Prevent registering personal devices into Azure
I have spent some time with device policies and conditional access requirements, but am yet unable to prevent a user from registering a non-company owned device into Azure.
Since moving to Intune, the ability to stop users from registering devices is no longer available as per screenshot. Our organization is a hybrid Azure/AD environment.
Would greatly appreciate any feedback from someone who has been able to achieve this.
5 Replies
Hi, How are the mdm/user intune scopes definied?
If a user is in both the MAM user scope and MDM user scope and the user adds a work or school account, the device will be Azure AD registered and not automatically enrolled in Intune
- Both the MAM and MDM scores are set to None.
What we are trying to achieve, is that a user is prevented from registering their personal device into Azure AD, but we are happy for them to use web applications such as Outlook/Teams via office.com on any device.Hi
Ahh Okay, I misunderstood the question I guess....
The restriction only can be managed in Azure AD. You can't restrict Azure AD join or registration when Intune MDM is configured.How to manage devices using the Azure portal | Microsoft Docs
You need to make sure when using intune, all the devices are managed and you block personal devices for enrollment. And of course conditional access to require compliant devices to access your data. But preventing the possibility to register devices is still not possible so far as I know.
I hope there will be some additional ca policies to block this
