Surface Pro, EMS, Azure AD Join & Device Enrollment Managers

[Stephen Bell]

Hello all,

My company just purchased some EMS licenses with the intention on deploying some Surface Pro devices to our mobile workforce.  

If these are joined to Azure AD using a Device Enrollment Manager account - do these limitations still apply?  Having no specific device user?  Not being able to to use per-user conditional access policies?

I guess I understand this with an iOS device -- because it only has 1 user - but with a windows device, the user authenticates with their Azure AD credentials, I would hope that user specific configuration would be able to apply to the device?

Any input would be appreciated.

Thanks

sb

[#2 · Accepted solution]

For Windows 1703, you can enroll those devices with a DEM account. Conditional access will work with a nonDEM account once the account logs in.

[#3]

Hi

If I was you I will try out Windows AutoPilot instead of DEM account.

Kind Reregards

Per Larsen

MVP - Enterprise Mobility

Blog: https://osddeployment.dk

[#4]

I agree with Per Larsen. Windows AutoPilot is the way to go in the long-term. It is fairly new and not all tenants may have it enabled at this time. Your tenant might be ready, so visit the link below for more info. https://docs.microsoft.com/en-us/windows/deployment/windows-10-auto-pilot

[#5]

Thank you. I would like to look into this. How do I know if it is available in my tenant?

[#6]

If you see Devices under the Manage page when you log into Windows Store for Business or EDU.