{
  "id": "CB-M365-DEVICE-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-003.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-003",
    "title": "Restrict who can join devices to Microsoft Entra ID",
    "finding": {
      "title": "Every user can join devices to Microsoft Entra ID",
      "description": "Any user, or an attacker holding any user's credentials, can join an arbitrary Windows, macOS or Linux machine to the tenant."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "device-join",
      "device-registration",
      "least-privilege"
    ],
    "description": "The device setting **Users may join devices to Microsoft Entra** is set to **Selected**, with\na group of users who provision devices (IT staff, enrollment accounts), or to **None** when all\ncorporate devices are joined through userless flows.\n\nThe setting covers user-driven Microsoft Entra join on Windows 10 or later, macOS and Linux. It\ndoes not apply to Microsoft Entra hybrid join, Azure virtual machines joined at creation, or\nWindows Autopilot self-deploying mode, which run without a user context.\n",
    "rationale": "An Entra-joined device obtains a Primary Refresh Token and a device identity that Conditional\nAccess, Intune and other services trust. An attacker with a stolen user password can join a\nmachine they control and use it to persist in the tenant, satisfy device-based conditions, or\nharvest tokens. Limiting join to provisioning staff removes that path for regular accounts.\n",
    "impact": "Users outside the selected group can no longer join new devices themselves, so user-driven\nout-of-box setup breaks for them. Windows Autopilot user-driven mode and Intune automatic\nenrollment run as the end user: either add those users to the allowed group or switch to\nself-deploying or pre-provisioned Autopilot. Existing joined devices are not affected.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Devices > Device settings > Users may join devices to Microsoft Entra",
      "default_value": "All",
      "recommended_value": "Selected (provisioning group) or None"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Devices** > **Device settings**.\n3. Check that **Users may join devices to Microsoft Entra** is **Selected** with a named\n   provisioning group, or **None**.\n4. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy` (scope\n   `Policy.Read.DeviceConfiguration`) and read `azureADJoin.allowedToJoin`: the `@odata.type`\n   must be `#microsoft.graph.enumeratedDeviceRegistrationMembership` or\n   `#microsoft.graph.noDeviceRegistrationMembership`.\n5. Fail if the setting is **All** (`allDeviceRegistrationMembership`).\n"
    },
    "remediation": {
      "manual": "1. Create a security group holding the accounts allowed to join devices (IT technicians,\n   enrollment accounts, or the users targeted by Autopilot user-driven profiles).\n2. In the Microsoft Entra admin center, browse to **Entra ID** > **Devices** >\n   **Device settings**. Role: Cloud Device Administrator.\n3. Set **Users may join devices to Microsoft Entra** to **Selected**, select the group, and\n   save.\n4. Graph equivalent: `PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy`\n   with the full policy object, `azureADJoin.allowedToJoin` set to an\n   `enumeratedDeviceRegistrationMembership` listing the group ID.\n",
      "rollback": "Set **Users may join devices to Microsoft Entra** back to **All**.\n"
    },
    "references": [
      {
        "title": "Manage devices in Microsoft Entra ID - Configure device settings",
        "url": "https://learn.microsoft.com/entra/identity/devices/manage-device-identities",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "deviceRegistrationPolicy resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/deviceregistrationpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.005"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-002",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-004",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-009",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}