Limit the number of devices each user can join or register

Description

The device setting Maximum number of devices per user is set to {{ max_devices_per_user }} or less. The quota counts Microsoft Entra joined and Microsoft Entra registered devices owned by each user. It does not apply to Microsoft Entra hybrid joined devices.

Intune has a separate enrollment device limit (Devices > Device onboarding > Enrollment > Device limit restriction, 1 to 15). It does not replace this Entra quota, which applies even without Intune.

Rationale

Each device identity can hold a Primary Refresh Token and satisfy device-based Conditional Access conditions. A low quota limits how many device objects a compromised account can create, for persistence or to flood the directory, and keeps per-user inventories readable. Microsoft sets the default to 50, which is far above what a normal user needs.

Impact

Users who reach the limit cannot register or join another device until an old device is removed. Staff who handle many devices (technicians, test accounts) should use a device enrollment manager account or bulk provisioning instead of their own account. Combine with the cleanup of stale devices so that retired devices do not use up the quota.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Devices > Device settings.
3. Read Maximum number of devices per user.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy and read userDeviceQuota.
5. Fail if the value is greater than {{ max_devices_per_user }} or is Unlimited.

Remediation

1. Find users above the target: in Entra ID > Devices > All devices, filter by owner, or export the list with Download devices and count devices per owner. Remove stale devices first.
2. Browse to Entra ID > Devices > Device settings. Role: Cloud Device Administrator.
3. Set Maximum number of devices per user to {{ max_devices_per_user }} (or lower) and save.
4. Graph equivalent: PUT https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy with the full policy object and userDeviceQuota set to the target value.

Rollback

Raise Maximum number of devices per user back to the previous value.

References

• Manage devices in Microsoft Entra ID - Configure device settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-003 Restrict who can join devices to Microsoft Entra ID
• related CB-M365-DEVICE-010 Configure an Intune cleanup rule for inactive devices

People and lifecycle