Restrict device enrollment for some users

[Fredrik Carenborn]

Hi

We have AD with Azure AD connect.
We use Intune MDM/MAM and auto-enroll Windows 10 devices, iOS and Android.
All users have the EMS license.

We are requesting a way to restrict the Intune enrollment for some users (not all) to only have one device.
Is there a way?

Im trying to think out a way with Conditional Access and Dynamic groups but I dont get it all the way.

We can go the other way around, restrict all users to only be able to register one device (this is easy). Then allow some users to register more.

Grateful for any tip or a nice complete solution

Cheers

[#2 · Accepted solution]

Hi Fredrik,

this is possible with "group-assigned enrollment restrictions". 

See Intune announcement "Week of November 27, 2017" here:

https://docs.microsoft.com/en-us/intune/whats-new#group-assigned-enrollment-restrictions----747598--...

So it's announced back in November but it's still in rollout (all my tenants do not have the feature available yet). So your tenant might not see the feature at the moment. Be patient and wait for it, it will exactly address your needs.

best,

Oliver

[#3]

That is great news. Altough I haven't seen it in our tenant yet. 

Is there a way to speed-up the "upgrade" ?

[#4]

No there is no way, you have to be patient. You need to wait until global rollout is finished.

best,

Oliver

[#5]

FYI: my tenant got updated and has enrollment restrictions now available...

[#6]

Ok. Still nothing at our tenant. Im placed at northen europe, Sweden.

[#7]

We are in west europe, tenant pprobably Amsterdam or Ireland.

[#8]

Ok I got it now in my tenant 😄