Restrict who can join devices to Microsoft Entra ID

Description

The device setting Users may join devices to Microsoft Entra is set to Selected, with a group of users who provision devices (IT staff, enrollment accounts), or to None when all corporate devices are joined through userless flows.

The setting covers user-driven Microsoft Entra join on Windows 10 or later, macOS and Linux. It does not apply to Microsoft Entra hybrid join, Azure virtual machines joined at creation, or Windows Autopilot self-deploying mode, which run without a user context.

Rationale

An Entra-joined device obtains a Primary Refresh Token and a device identity that Conditional Access, Intune and other services trust. An attacker with a stolen user password can join a machine they control and use it to persist in the tenant, satisfy device-based conditions, or harvest tokens. Limiting join to provisioning staff removes that path for regular accounts.

Impact

Users outside the selected group can no longer join new devices themselves, so user-driven out-of-box setup breaks for them. Windows Autopilot user-driven mode and Intune automatic enrollment run as the end user: either add those users to the allowed group or switch to self-deploying or pre-provisioned Autopilot. Existing joined devices are not affected.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Devices > Device settings.
3. Check that Users may join devices to Microsoft Entra is Selected with a named provisioning group, or None.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy (scope Policy.Read.DeviceConfiguration) and read azureADJoin.allowedToJoin: the @odata.type must be #microsoft.graph.enumeratedDeviceRegistrationMembership or #microsoft.graph.noDeviceRegistrationMembership.
5. Fail if the setting is All (allDeviceRegistrationMembership).

Remediation

1. Create a security group holding the accounts allowed to join devices (IT technicians, enrollment accounts, or the users targeted by Autopilot user-driven profiles).
2. In the Microsoft Entra admin center, browse to Entra ID > Devices > Device settings. Role: Cloud Device Administrator.
3. Set Users may join devices to Microsoft Entra to Selected, select the group, and save.
4. Graph equivalent: PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy with the full policy object, azureADJoin.allowedToJoin set to an enumeratedDeviceRegistrationMembership listing the group ID.

Rollback

Set Users may join devices to Microsoft Entra back to All.

References

• Manage devices in Microsoft Entra ID - Configure device settings Microsoft, vendor-doc, accessed 2026-10-24
• deviceRegistrationPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-002 Block Intune enrollment of personally owned devices by default
• related CB-M365-DEVICE-004 Limit the number of devices each user can join or register
• related CB-M365-DEVICE-009 Require MFA to register or join devices through Conditional Access

People and lifecycle