{
  "id": "CB-M365-DEVICE-002",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-002",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-002.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-002.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-002",
    "title": "Block Intune enrollment of personally owned devices by default",
    "finding": {
      "title": "Personally owned devices can enroll in Intune",
      "description": "Users can enroll their own phones and computers, which then count as managed corporate devices for access decisions."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "intune",
      "enrollment",
      "byod",
      "device-management"
    ],
    "applicability": {
      "requires": [
        "Microsoft Intune"
      ]
    },
    "description": "The default Intune **Device platform restriction** policy (the one with the lowest priority,\nnamed **All users**) blocks **Personally owned** devices for every platform in use: Windows,\nmacOS, iOS/iPadOS and Android Enterprise work profile. Platforms the organization does not use\nare blocked entirely. Exceptions for specific groups are granted by a higher-priority restriction\npolicy, never by loosening the default one.\n\nCorporate devices still enroll through corporate methods: Windows Autopilot, Apple Automated\nDevice Enrollment, corporate device identifiers, bulk provisioning or a device enrollment manager\naccount.\n",
    "rationale": "A personal device enrolled in Intune becomes a managed, possibly compliant device in Entra ID. It\nthen passes Conditional Access checks meant for corporate devices, while the organization does\nnot control its hardware, its other users or its lifecycle. Blocking personal enrollment by\ndefault keeps \"managed\" meaning \"owned by the organization\", and pushes personal devices to app\nprotection policies (MAM) instead.\n",
    "impact": "Users can no longer enroll personal devices through the Company Portal or the Windows \"Add work\naccount\" flow. Organizations with a BYOD program must create a higher-priority platform\nrestriction for the BYOD group, or move those users to app protection policies without\nenrollment. iOS/iPadOS and macOS devices are classified as personal unless they enroll through\nAutomated Device Enrollment or are registered by serial number: register corporate devices first.\n",
    "notes": "Microsoft states that enrollment restrictions are not a security boundary: a compromised device\ncan misreport its ownership. They prevent accidental enrollment and are combined with\nConditional Access and compliance policies. Userless enrollments (Autopilot self-deploying,\nbulk enrollment, co-management) always use the default policy.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Devices** > **Device onboarding** > **Enrollment** > **Device platform\n   restriction**.\n3. For each platform tab (Windows, macOS, iOS/iPadOS, Android), open the **All users** default\n   policy and check under **Platform settings** that **Personally owned devices** is **Block**\n   for every allowed platform.\n4. Review higher-priority restriction policies that allow personal devices: each must target a\n   named group with an approved BYOD exception.\n5. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   \"https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations\"` and read\n   `personalDeviceEnrollmentBlocked` in the platform restriction objects of the default\n   configuration (priority 0).\n6. Fail if the default policy allows personally owned devices on any platform in use.\n"
    },
    "remediation": {
      "manual": "1. Register existing corporate iOS/iPadOS and macOS devices by serial number, or enroll them\n   through Automated Device Enrollment, so they are not reclassified as personal.\n2. In the Intune admin center, browse to **Devices** > **Device onboarding** > **Enrollment** >\n   **Device platform restriction**.\n3. On each platform tab, open the **All users** default policy, select **Properties** >\n   **Platform settings** > **Edit**, and set **Personally owned devices** to **Block** (block\n   the platform itself if it is not used). Save. Role: Intune Administrator, or a custom role\n   with the **Enrollment programs** update permission.\n4. If a BYOD program exists, create a restriction policy with a higher priority that allows\n   personal devices for the BYOD group only.\n",
      "rollback": "Set **Personally owned devices** back to **Allow** in the default restriction policy of the\naffected platform.\n"
    },
    "references": [
      {
        "title": "Overview of enrollment restrictions",
        "url": "https://learn.microsoft.com/intune/device-enrollment/restrictions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-8",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-001",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-003",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}