Surface Pro, EMS, Azure AD Join & Device Enrollment Managers

Stephen Bell

Hello all,

My company just purchased some EMS licenses with the intention on deploying some Surface Pro devices to our mobile workforce.  


If these are joined to Azure AD using a Device Enrollment Manager account - do these limitations still apply?  Having no specific device user?  Not being able to to use per-user conditional access policies?


I guess I understand this with an iOS device -- because it only has 1 user - but with a windows device, the user authenticates with their Azure AD credentials, I would hope that user specific configuration would be able to apply to the device?


Any input would be appreciated.




5 Replies
For Windows 1703, you can enroll those devices with a DEM account. Conditional access will work with a nonDEM account once the account logs in.




If I was you I will try out Windows AutoPilot instead of DEM account.


Kind Reregards

Per Larsen

MVP - Enterprise Mobility


I agree with Per Larsen. Windows AutoPilot is the way to go in the long-term. It is fairly new and not all tenants may have it enabled at this time. Your tenant might be ready, so visit the link below for more info.
Thank you. I would like to look into this. How do I know if it is available in my tenant?

If you see Devices under the Manage page when you log into Windows Store for Business or EDU.

Related Conversations
Get the user role from Azure AD by Laravel azure ad oauth
Arulraj123 in Azure on
0 Replies
Microsoft Developer Virtual Conference
Jenn Jinhong in Community Events List on
0 Replies
Technine - March Updates on Technlogy
Thomas_Collier in Community Events List on
0 Replies
Create a tenant in Windows Virtual Desktop
julian3216 in Azure on
6 Replies
Azure Storage vs SharePoint Document Library
telecaster in Azure on
0 Replies