Forum Discussion
Prevent registering personal devices into Azure
I have spent some time with device policies and conditional access requirements, but am yet unable to prevent a user from registering a non-company owned device into Azure. Since moving to Int...
Both the MAM and MDM scores are set to None.
What we are trying to achieve, is that a user is prevented from registering their personal device into Azure AD, but we are happy for them to use web applications such as Outlook/Teams via office.com on any device.
What we are trying to achieve, is that a user is prevented from registering their personal device into Azure AD, but we are happy for them to use web applications such as Outlook/Teams via office.com on any device.
Hi
Ahh Okay, I misunderstood the question I guess....
The restriction only can be managed in Azure AD. You can't restrict Azure AD join or registration when Intune MDM is configured.
How to manage devices using the Azure portal | Microsoft Docs
You need to make sure when using intune, all the devices are managed and you block personal devices for enrollment. And of course conditional access to require compliant devices to access your data. But preventing the possibility to register devices is still not possible so far as I know.
I hope there will be some additional ca policies to block this
- Thank you thats very helpful.
Personal devices are set to blocked, which does stop them enrolling but not registering, which as I have just learn doesn't seem possible.
I will therefore look into building a policy that will allow for web access from any device, but prevent the usage of 'full clients' on non-hybrid joined devices which we do not manage.- Yeah, It's a bit annoying when you opened up AAD devices(without the filter) and you see so many random device names. The good thing is they do not show up in Intune.
Surely conditional access will manage the app restriction for you.
