May 20 2021 06:23 AM
I have spent some time with device policies and conditional access requirements, but am yet unable to prevent a user from registering a non-company owned device into Azure.
Since moving to Intune, the ability to stop users from registering devices is no longer available as per screenshot. Our organization is a hybrid Azure/AD environment.
Would greatly appreciate any feedback from someone who has been able to achieve this.
May 20 2021 06:46 AM
Hi, How are the mdm/user intune scopes definied?
If a user is in both the MAM user scope and MDM user scope and the user adds a work or school account, the device will be Azure AD registered and not automatically enrolled in Intune
May 20 2021 07:11 AM
May 20 2021 07:22 AM - edited May 20 2021 07:34 AM
Hi
Ahh Okay, I misunderstood the question I guess....
The restriction only can be managed in Azure AD. You can't restrict Azure AD join or registration when Intune MDM is configured.
How to manage devices using the Azure portal | Microsoft Docs
You need to make sure when using intune, all the devices are managed and you block personal devices for enrollment. And of course conditional access to require compliant devices to access your data. But preventing the possibility to register devices is still not possible so far as I know.
I hope there will be some additional ca policies to block this
May 20 2021 07:39 AM
May 22 2021 05:20 AM