Allow user to AAD Join & InTune Enroll company devices only , not personal owned Win Pro/Ent device

%3CLINGO-SUB%20id%3D%22lingo-sub-1957146%22%20slang%3D%22en-US%22%3EAllow%20user%20to%20AAD%20Join%20%26amp%3B%20InTune%20Enroll%20company%20devices%20only%20%2C%20not%20personal%20owned%20Win%20Pro%2FEnt%20device%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1957146%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20trying%20to%20work%20out%20the%20best%20way%20of%20achieving%20the%20following%20restrictions%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAllow%20Staff%20user%20accounts%20to%20be%20able%20to%20AAD%20Join%20and%20InTune%20AutoEnroll%26nbsp%3B%20company%20owned%20devices%3C%2FP%3E%3CP%3EBlock%20Staff%20from%20AAD%20Joining%20and%20AutoEnrolling%20personal%20devices%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20obvious%20configuration%20for%20this%20is%20to%20set%20the%20staff%20users%20accounts%20group%20in%20AAD%20to%20be%20allowed%20to%20AAD%20Join%20and%20in%20InTune%20allow%20them%20to%20Auto%20Enroll%20whilst%20setting%20an%20Enrollment%20Restriction%20Policy%20for%20blocking%20personal%20devices.%20That%20is%20all%20good%20in%20theory%20%2C%20but%20the%20reality%20of%20that%20is%20that%20if%20a%20staff%20user%20has%20a%20personal%20devices%20that%20has%20Windows%20Pro%2C%20Enterprise%20or%20Education%20installed%20this%20configuration%20means%20they%20can%20still%20AAD%20Joined%20and%20InTune%20AutoEnroll.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3BIs%20there%20a%20way%20to%20make%20certain%20only%20company%20owned%20devices%20can%20be%20Joined%2FEnrolled%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20fact%20that%20most%20personal%20users%20will%20have%20Windows%20Home%20mitigate%20some%20of%20the%20risk%20and%20we%20are%20planning%20to%20use%20AutoPilot%20registration%20as%20an%20additional%20way%20of%20controlling%20things%20so%20we%20can%20design%20the%20InTune%20app%20and%20policy%20assignments%20groups%20so%20that%20they%20are%20populated%20only%20by%20devices%20with%20the%20HWID%20registered%2C%20so%20if%20done%20correctly%20even%20if%20they%20do%20enroll%20a%20personal%20device%20it%20wont%20receive%20any%20apps%20or%20policies%20anyway.%20There%20is%20the%20setting%20to%20restrict%20users%20to%20only%20be%20able%20to%20enroll%20or%20AAD%20join%201%20device%20that%20could%20be%20configured%20but%20that%20doesn't%20stop%20them%20enrolling%20a%20personal%20device%20if%20they%20haven't%20enrolled%20a%20device%20already%20plus%20it%20is%20a%20tenant%20wide%20setting%20so%20removes%20flexibility%20for%20users%20that%20we%20might%20want%20to%20allow%20to%20enroll%20and%20join%20multiple%20devices.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20cant%20help%20but%20wonder%20if%26nbsp%3B%20there%20is%20a%20simpler%20%2C%20more%20robust%20way%20of%20doing%20this%3F%20The%20ideal%20scenario%20for%20us%20is%20to%20simply%20be%20able%20to%20say%20-%20only%20devices%20with%20registered%20HWID%20can%20be%20enrolled.%20Am%20I%20missing%20something%20that%20enables%20this%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1957146%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAAD%20Join%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Eenrollment%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1957886%22%20slang%3D%22en-US%22%3ERe%3A%20Allow%20user%20to%20AAD%20Join%20%26amp%3B%20InTune%20Enroll%20company%20devices%20only%20%2C%20not%20personal%20owned%20Win%20Pro%2FEnt%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1957886%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F646041%22%20target%3D%22_blank%22%3E%40PhilRiceUoS%3C%2FA%3E%26nbsp%3BAre%20you%20using%20conditional%20access%20policies%3F%20The%20only%20thing%20I%20can%20think%20of%20outside%20of%20what%20you%20mentioned%20is%20to%20take%20a%20crack%20at%20setting%20up%20some%20conditional%20access%20policies%20that%20would%20incorporate%20the%20conditions%20you%20are%20trying%20to%20reach.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1962067%22%20slang%3D%22en-US%22%3ERe%3A%20Allow%20user%20to%20AAD%20Join%20%26amp%3B%20InTune%20Enroll%20company%20devices%20only%20%2C%20not%20personal%20owned%20Win%20Pro%2FEnt%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1962067%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F646041%22%20target%3D%22_blank%22%3E%40PhilRiceUoS%3C%2FA%3E%26nbsp%3BCan%20you%20share%20your%20enrollment%20restrictions%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAccording%20to%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fintune%2Fenrollment%2Fenrollment-restrictions-set%23blocking-personal-windows-devices%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Edocumentation%3C%2FA%3E%20and%20the%20experience%20I%20have%2C%20personal%20devices%20will%20be%20blocked%20if%20you%20setup%20correctly.%20A%20company%20owned%20device%20is%20defined%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3EThe%20enrolling%20user%20is%20using%20a%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fintune%2Fenrollment%2Fdevice-enrollment-manager-enroll%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Edevice%20enrollment%20manager%20account%3C%2FA%3E.%3C%2FLI%3E%3CLI%3EThe%20device%20enrolls%20through%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fautopilot%2Fenrollment-autopilot%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EWindows%20Autopilot%3C%2FA%3E.%3C%2FLI%3E%3CLI%3EThe%20device%20is%20registered%20with%20Windows%20Autopilot%20but%20isn't%20an%20MDM%20enrollment%20only%20option%20from%20Windows%20Settings.%3C%2FLI%3E%3CLI%3EThe%20device's%20IMEI%20number%20is%20listed%20in%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EDevice%20enrollment%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%26gt%3B%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fintune%2Fenrollment%2Fcorporate-identifiers-add%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ECorporate%20device%20identifiers%3C%2FA%3E%3C%2FSTRONG%3E.%3C%2FLI%3E%3CLI%3EThe%20device%20enrolls%20through%20a%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fintune%2Fenrollment%2Fwindows-bulk-enroll%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ebulk%20provisioning%20package%3C%2FA%3E.%3C%2FLI%3E%3CLI%3EThe%20device%20enrolls%20through%20GPO%2C%20or%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fconfigmgr%2Fcomanage%2Fquickstart-paths%23bkmk_path1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Eautomatic%20enrollment%20from%20Configuration%20Manager%20for%20co-management%3C%2FA%3E.%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E
Contributor

I am trying to work out the best way of achieving the following restrictions:

 

Allow Staff user accounts to be able to AAD Join and InTune AutoEnroll  company owned devices

Block Staff from AAD Joining and AutoEnrolling personal devices

 

The obvious configuration for this is to set the staff users accounts group in AAD to be allowed to AAD Join and in InTune allow them to Auto Enroll whilst setting an Enrollment Restriction Policy for blocking personal devices. That is all good in theory , but the reality of that is that if a staff user has a personal devices that has Windows Pro, Enterprise or Education installed this configuration means they can still AAD Joined and InTune AutoEnroll.

 

 Is there a way to make certain only company owned devices can be Joined/Enrolled?

 

The fact that most personal users will have Windows Home mitigate some of the risk and we are planning to use AutoPilot registration as an additional way of controlling things so we can design the InTune app and policy assignments groups so that they are populated only by devices with the HWID registered, so if done correctly even if they do enroll a personal device it wont receive any apps or policies anyway. There is the setting to restrict users to only be able to enroll or AAD join 1 device that could be configured but that doesn't stop them enrolling a personal device if they haven't enrolled a device already plus it is a tenant wide setting so removes flexibility for users that we might want to allow to enroll and join multiple devices.

 

I cant help but wonder if  there is a simpler , more robust way of doing this? The ideal scenario for us is to simply be able to say - only devices with registered HWID can be enrolled. Am I missing something that enables this?

 

Thanks

 

6 Replies

@PhilRiceUoS Are you using conditional access policies? The only thing I can think of outside of what you mentioned is to take a crack at setting up some conditional access policies that would incorporate the conditions you are trying to reach. 

Not something I've looked at in relation to this but I will explore that idea further to see if I can get something working. Thanks for the suggestion

@PhilRiceUoS Can you share your enrollment restrictions? 

 

According to the documentation and the experience I have, personal devices will be blocked if you setup correctly. A company owned device is defined:

 

@JanBakkerOrphaned 

 

the planned restrictions will be :

 

-  in AAD set staff user group to be allowed to AAD join devices

- in Intune set staff user group to be allowed to AutoEnroll in InTune (tested having this disabled but this stops Autopilot from working properly)

- Enrollment restriction policy - set to Allow Windows 10 but block personal devices and block all other platform types.

 

We are planning to only enroll devices by either AutoPilot for new builds or with staff enrolling themselves for other devices. So DEM accounts, provisioning packages etc wont apply in this case as we don't want to encounter the limitations they incur.

 

In the above configuration a staff user wont be able to AAD join or InTune Enroll a Windows 10 HOME device , which will be the majority of BYOD devices.

Windows Home cannot AAD join anyway so essentially all blocking personal devices does is stop AAD registered devices from InTune Enrolling.

The problem im trying to resolve is the specific case of when a staff user (therefore allowed to AAD enroll) has their own device that has Windows Pro/Enterprise level OS , which results in them being able to AAD and therefore InTune Enroll because an AAD joined device is seen as Corporate automatically.

I think the issue / confusion lies in the way the label 'Personal' is use and lack of ability to differenciate between a company owned device and a personally owned device by using registration of HWIDs, serial numbers etc.

'Personal' device simply means a device that is AAD registered and not AAD joined , which actually makes sense giving AAD registered is mostly for BYOD. However, if you are trying to let users enroll company devices , as will be a common enough requirement in todays WFH scenarios, it doesnt seem straight forward to be able to stop them from enrolling personal Win Pro/Ent machines.

 

@caseykraus  after looking at CA for this I don't think it is possible to achieve. Conditional access policies I actually find quite limited TBH and hopefully they will increase the features they offer a lot more in the future.

@PhilRiceUoS 

 

You are wrong in assuming that an AAD joined device is seen as corporate.

Nothing about AAD joined defines the ownership for a device.

A device is corporate when: Set enrollment restrictions in Microsoft Intune | Microsoft Docs

 

So this means in your case, just block personal devices and you will be golden. It's what I do for multiple customers