We were a bit surprised to find out that a regular user can see the list of all devices using portal.azure.com
They can see the name and owner of the device, the OS version, when it was activated. Most actions are greyed out, but Disable and Remove aren't greyed out. We tried the actions on one device and luckily it resulted in an error.
Is everyone ok with this info being available to all users, or is it possible to hide this?