Preventing Azure AD Registration / Microsoft Support can not help

[James1315]

Hello, 

I want prevent that users itself register personal windows device in Azure AD.

1. When I disable the option "Users may register their dervices with Azure AD" my Intune management will disabled completely. 

2. Azure AD =>  Mobility (MDM and MAM) => This Option have no impact to the AD register process. 

3. Intune => Enroll devices | Enrollment device platform restrictions => I have set everything to block.

For what reason the restriction don't block this register process?

I have tested to resolve this over conditional access no success..

Thanks for your help =)

[#2]

Hi James1315,

There is no solution to control Azure AD registered devices. You will have to manually audit and clean-up these devices on a regular basis.

[#3]

Hi MathieuVandenHautte,
thanks for your message.

This is incredible. And in bigger environments not handable. The primary goal should be that the admin can control in which scenario devices can be register.

[#4]

@James1315 

To prevent users from registering their personal Windows devices in Azure AD, you can configure the device registration settings in Azure AD. Here's how you can achieve this:

1. Sign in to the Azure portal (https://portal.azure.com) using your administrator account.

2. Navigate to the Azure Active Directory service.

3. In the Azure Active Directory blade, go to "Devices" and then select "Device settings."

4. Under the "Device settings" section, locate the option "Users may register their devices with Azure AD" and set it to "No."

5. Save the changes by clicking on the "Save" button.

By disabling user device registration in Azure AD, users will no longer be able to register their personal Windows devices with Azure AD.

It's important to note that this configuration will only prevent users from registering personal Windows devices. Organization-owned devices that are provisioned and managed by your organization will still be able to join Azure AD as part of the device management process.

Additionally, keep in mind that this setting may impact other scenarios where device registration is required, such as accessing certain Microsoft 365 services or using Azure AD features like conditional access. Consider reviewing your organization's requirements and evaluating the impact of this configuration before applying it.

[#5]

Hi,
Yes this is the configuration from the first position in my post. The button is greyed out and I can disable this via the PS command, "Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Intune'" | Set-AzureADServicePrincipal -AccountEnabled $false"
But this disabled the Intune functionality entirely.

[#6]

Hi Samsjam,
I have make different test's. I'm don't see how I can disable the AD device registration process over this way.

[#7]

Hello! I apologize, but it seems there might https://techzone-agency.com/ some confusion in your message. As an AI language model, I don't have access to your previous conversations or interactions. Additionally, I don't have any specific context about the "AD device registration process" you mentioned.

However, if you are referring to Active Directory (AD) device registration and you want to disable it, here are some general steps you can follow:

Group Policy: If your organization uses Group Policy, you may be able to disable device registration through group policy settings. Contact your system administrator or IT department to check if there are any policies in place to manage device registration.

Azure AD: If you are using Azure Active Directory (Azure AD) for device registration, you may need to check the Azure AD settings to disable device registration. You can log in to the Azure portal (portal.azure.com), navigate to "Azure Active Directory," and explore the "Devices" section to manage device registration settings.

Intune: If your organization uses Microsoft Intune for device management, there may be settings in Intune that control device registration. Check Intune policies to see if there are any configurations related to device registration.

Registry Settings: In some cases, device registration settings might be controlled through registry settings. However, modifying the registry can be risky and may lead to system instability if not done correctly. If you are not familiar with registry editing, it's best to avoid this option.

Network Configuration: Sometimes, device registration might be triggered by network configuration or DHCP settings. If you are on a corporate network, consult your network administrator to see if there are any network-related settings affecting device registration.

Please note that the steps to disable device registration may vary depending on your organization's setup and the specific tools and policies in use. It is crucial to consult your system administrator or IT support team before making any changes to device registration settings, as these changes may impact your organization's security and management practices.

If you provide more specific details about your environment and the type of device registration you are referring to, I might be able to provide more tailored guidance.

[#8]

https://call4cloud.nl/2021/08/the-battle-between-aadj-and-aadr/#part4
Should tell you enough :) but yeah...registered devices is indeed a fun thing

[#9]

If you're looking to prevent Azure AD registration on a Windows device and you've found that Microsoft Support is unable to assist, you might need to take matters into your own hands. Here are some steps you can consider taking:

1. Group Policy: If you have access to Group Policy settings (especially on Windows Pro, Enterprise, or Education editions), you can configure policies to control Azure AD registration. Look for policies related to "User Account Control" or "Azure AD Join." These policies can help restrict or control the registration process.

2. Registry Edits: Be cautious with this option, as editing the Windows Registry can potentially cause issues if not done correctly. However, there might be specific registry keys you can modify to prevent Azure AD registration. Before making any changes, it's wise to back up your registry and research thoroughly.

3. Local Account Creation: Consider creating local user accounts instead of Microsoft accounts during the initial setup of your Windows device. This can help prevent the automatic Azure AD registration that typically occurs with Microsoft accounts.

4. Network Configuration: In some cases, Azure AD registration might be triggered when the device is connected to a specific network. You can try disconnecting from the network during setup and connecting after setting up the local account.

5. Offline Setup: Disconnect your device from the internet during the initial setup process. This might prevent the automatic Azure AD registration. However, keep in mind that this approach could limit some functionality until you reconnect.

6. Professional Assistance: If you're uncomfortable with advanced settings or edits, consider consulting with an IT professional or consultant who has expertise in managing Windows devices and Azure AD.

Remember that while these steps might help prevent Azure AD registration, they could also have unintended consequences or limit some functionality. Always ensure you have backups of your data and system settings before making any significant changes. Additionally, research thoroughly or consult with professionals to avoid potential issues.

[#10]

nice

[#11]

nice