Surface Pro, EMS, Azure AD Join & Device Enrollment Managers

Iron Contributor

Hello all,

My company just purchased some EMS licenses with the intention on deploying some Surface Pro devices to our mobile workforce.  


If these are joined to Azure AD using a Device Enrollment Manager account - do these limitations still apply?  Having no specific device user?  Not being able to to use per-user conditional access policies?


I guess I understand this with an iOS device -- because it only has 1 user - but with a windows device, the user authenticates with their Azure AD credentials, I would hope that user specific configuration would be able to apply to the device?


Any input would be appreciated.




5 Replies
best response confirmed by Stephen Bell (Iron Contributor)
For Windows 1703, you can enroll those devices with a DEM account. Conditional access will work with a nonDEM account once the account logs in.




If I was you I will try out Windows AutoPilot instead of DEM account.


Kind Reregards

Per Larsen

MVP - Enterprise Mobility


I agree with Per Larsen. Windows AutoPilot is the way to go in the long-term. It is fairly new and not all tenants may have it enabled at this time. Your tenant might be ready, so visit the link below for more info.
Thank you. I would like to look into this. How do I know if it is available in my tenant?

If you see Devices under the Manage page when you log into Windows Store for Business or EDU.