Enrollment restrictions¶
Enrollment restrictions decide which devices are allowed into Intune. They keep unsupported platforms and personal devices out, and stop one person from enrolling a pile of devices.
Restrictions are a hygiene control, not a security boundary
A compromised or modified device can misrepresent itself. Restrictions keep honest users on the right path. Conditional Access and compliance are what actually protect your data.
Two kinds of restriction¶
| Restriction | Controls | Where |
|---|---|---|
| Device platform restriction | Allowed platforms, minimum and maximum OS version, Android manufacturers, and whether personally owned devices may enroll | Devices > Enrollment > platform tab > Device platform restriction |
| Device limit restriction | How many devices one user can enroll (1 to 15) | Devices > Enrollment > platform tab > Device limit restriction |
How they apply:
- Each type has a default policy that applies to everyone. Edit it, then add higher-priority policies for exceptions, such as a higher device limit for IT staff.
- Restrictions are assigned to user groups and evaluated by priority. Platform restrictions also support assignment filters.
- Group and filter changes take about 15 minutes to reach enrollment. Don't add a user to a group and enroll in the same minute.
- OS version restrictions on Android and iOS/iPadOS only apply to enrollments through Company Portal. Automated methods ignore them.
- Creating device limit restrictions requires the Intune Administrator role. Other roles can only read them.
Recommended baseline¶
| Platform | Personal devices | Corporate devices | Notes |
|---|---|---|---|
| Windows | Block | Allow, through Autopilot or with corporate identifiers | See the ownership table below before blocking |
| macOS | Block, unless you support BYOD Macs | Allow through Automated Device Enrollment | |
| iOS/iPadOS | Allow user enrollment, or block and use app protection | Allow through Automated Device Enrollment | Set a minimum OS version for Company Portal enrollments |
| Android Enterprise work profile | Allow if you support BYOD | n/a | |
| Android device administrator | Block | Block | Deprecated |
Set the device limit to something realistic, for example 5. Remember that Entra ID has its own Maximum number of devices per user setting, and the lower of the two effectively wins for most enrollment types.
Blocking personal Windows devices¶
Windows decides ownership differently from other platforms, and it's easy to block your own corporate devices by mistake. This table, from Microsoft's documentation, shows what happens when personal devices are blocked:
| Windows enrollment method | Without corporate identifiers | With corporate identifiers uploaded |
|---|---|---|
| Windows Autopilot (classic) | Corporate | Corporate |
| GPO or Configuration Manager co-management | Corporate | Corporate |
| Bulk provisioning package | Corporate | Corporate |
| Device enrollment manager | Corporate | Corporate |
| Azure Virtual Desktop (not hybrid) | Corporate | Corporate |
| Entra join during Windows setup | Corporate, but blocked by a personal restriction | Personal unless the device matches an identifier |
| Entra join from Windows Settings | Corporate, but blocked by a personal restriction | Personal unless the device matches an identifier |
| Autopilot for existing devices | Corporate, but blocked by a personal restriction | Personal unless the device matches an identifier |
| Autopilot device preparation | Corporate, but blocked by a personal restriction | Personal unless the device matches an identifier |
| Add work account from Settings, MDM-only enrollment, Company Portal, or "Allow my organization to manage my device" in an app | Personal | Personal unless the device matches an identifier |
The practical result: if you block personal Windows devices, classic Autopilot-registered devices are fine, but Autopilot device preparation and plain Entra join need corporate identifiers (or device association for device preparation).
Corporate identifiers¶
Corporate identifiers mark specific devices as corporate when they enroll. Upload them under Devices > Enrollment > Corporate device identifiers.
| Platform | Identifier |
|---|---|
| Windows 10 22H2 and Windows 11 22H2 or later (with the 2024 updates) | Manufacturer, model and serial number in one CSV line |
| iOS/iPadOS | Serial number (preferred) or IMEI |
| macOS | Serial number |
| Android | IMEI or serial number. Serial numbers aren't always reliable on Android, so check with your supplier. |
CSV format rules:
- No header row, one identifier type per file, up to 5,000 rows or 5 MB per file.
- Windows example:
Lenovo,ThinkPad T14,PF0ABCDE - You can upload up to 10 Windows CSV files in the admin center. For more, use Microsoft Graph.
Get the Windows values from a device with:
Get-CimInstance -ClassName Win32_ComputerSystem | ForEach-Object {
$_.Manufacturer, $_.Model, (Get-CimInstance -ClassName Win32_BIOS).SerialNumber -join ','
}
Windows corporate identifiers only count at enrollment
They decide whether the enrollment is allowed. After enrollment, the device's ownership follows the normal rules in the table above. A device that enrolled through Add work account shows as personal afterwards even if it matched an identifier. Change ownership manually in the device properties if needed.
Apple user enrollment (account-driven or with Company Portal) doesn't support corporate identifiers, because the device doesn't share its serial number or IMEI with MDM.
Device enrollment managers¶
A device enrollment manager (DEM) account can enroll up to 1,000 devices and bypasses the device limit. Devices enrolled by a DEM are corporate-owned but have no real user, so they can't use user-based Conditional Access, Company Portal device actions or user-targeted policies. Use Autopilot self-deploying, Apple ADE without user affinity, or Android dedicated enrollment instead whenever you can.
Troubleshooting blocked enrollments¶
- Go to Devices > Monitor > Enrollment failures and find the user or device.
- A failure reason of Enrollment restriction not met means a platform or ownership restriction blocked it. DeviceCapReached means the device limit.
- Check which restriction applied: restrictions are evaluated by priority, and the user may be in a group you didn't expect.
- For device limits, remove stale devices from the user, or raise the limit for that group. Device limit restrictions only count devices that have contacted Intune in the last 90 days.