Block Intune enrollment of personally owned devices by default

Description

The default Intune Device platform restriction policy (the one with the lowest priority, named All users) blocks Personally owned devices for every platform in use: Windows, macOS, iOS/iPadOS and Android Enterprise work profile. Platforms the organization does not use are blocked entirely. Exceptions for specific groups are granted by a higher-priority restriction policy, never by loosening the default one.

Corporate devices still enroll through corporate methods: Windows Autopilot, Apple Automated Device Enrollment, corporate device identifiers, bulk provisioning or a device enrollment manager account.

Microsoft states that enrollment restrictions are not a security boundary: a compromised device can misreport its ownership. They prevent accidental enrollment and are combined with Conditional Access and compliance policies. Userless enrollments (Autopilot self-deploying, bulk enrollment, co-management) always use the default policy.

Rationale

A personal device enrolled in Intune becomes a managed, possibly compliant device in Entra ID. It then passes Conditional Access checks meant for corporate devices, while the organization does not control its hardware, its other users or its lifecycle. Blocking personal enrollment by default keeps "managed" meaning "owned by the organization", and pushes personal devices to app protection policies (MAM) instead.

Impact

Users can no longer enroll personal devices through the Company Portal or the Windows "Add work account" flow. Organizations with a BYOD program must create a higher-priority platform restriction for the BYOD group, or move those users to app protection policies without enrollment. iOS/iPadOS and macOS devices are classified as personal unless they enroll through Automated Device Enrollment or are registered by serial number: register corporate devices first.

Applies when

Requires: Microsoft Intune

Audit

1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a Global Reader.
2. Browse to Devices > Device onboarding > Enrollment > Device platform restriction.
3. For each platform tab (Windows, macOS, iOS/iPadOS, Android), open the All users default policy and check under Platform settings that Personally owned devices is Block for every allowed platform.
4. Review higher-priority restriction policies that allow personal devices: each must target a named group with an approved BYOD exception.
5. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations" and read personalDeviceEnrollmentBlocked in the platform restriction objects of the default configuration (priority 0).
6. Fail if the default policy allows personally owned devices on any platform in use.

Remediation

1. Register existing corporate iOS/iPadOS and macOS devices by serial number, or enroll them through Automated Device Enrollment, so they are not reclassified as personal.
2. In the Intune admin center, browse to Devices > Device onboarding > Enrollment > Device platform restriction.
3. On each platform tab, open the All users default policy, select Properties > Platform settings > Edit, and set Personally owned devices to Block (block the platform itself if it is not used). Save. Role: Intune Administrator, or a custom role with the Enrollment programs update permission.
4. If a BYOD program exists, create a restriction policy with a higher priority that allows personal devices for the BYOD group only.

Rollback

Set Personally owned devices back to Allow in the default restriction policy of the affected platform.

References

• Overview of enrollment restrictions Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-DEVICE-001 Mark devices without a compliance policy as not compliant
• related CB-M365-DEVICE-003 Restrict who can join devices to Microsoft Entra ID

People and lifecycle