How to Block Personal Windows Devices Enrollment

0
Block Personal Windows Devices

After long wait now you can block Windows personal devices from enrolling into Microsoft Intune. Microsoft rolled out this restriction options all Intune tenants. I’ve a previous post from Jan 2017 learn how to restrict personal iOS devices from enrolling into Intune. Learn how to block personal Windows devices from Intune enrolment and to access corp resources.

[Related PostDifference Between Intune Enrollment Restriction and Device Restriction Profile]

Differences between Device TYPE and LIMIT Restrictions

Device LIMIT restriction is the policy to restrict the number of devices a user can enroll into Intune. The default value of Intune device limit restriction is five(5). The maximum value of Intune device limit is fifteen(15).

  • Default – 5 Devices
  • Maximum – 15 Devices

Device TYPE restriction is the policy to restrict or block devices based following category:

  • Platform of the device (iOS, Android, Windows, MacOS)
  • Ownership of the device (Personal, Corporate)

Block Personal Windows Devices

Video Tutorial Block Personal Windows Devices

Video tutorial explains following experience in details.

  • Device Type Restricitions
  • Device Limit Restricitions
  • Block Mobile platform
  • Block Windows Personal Devices
  • End-user Experience Windows 10 Personal Computer
  • Intune Admin Experience – Block personal Windows devices

[Related PostDifference Between Intune Enrollment Restriction and Device Restriction Profile]

How to Block Personal Windows Devices?

You can block personal Windows devices from Intune Enrollment restrictions blade. Follow the steps mentioned below or check out the video tutorial above to block personal devices from enrolling into Intune.

There are two options to create Intune Device type policies. You can update the default policy which is deployed to All Users. This policy would be a tenant wide setting for all users. Or you can create a custom device type policy and deploy it to a set of users.

In the following example, I can

  1. Sign in to the Azure portal
  2. Select More Services, search for Intune, and then choose Intune
  3. Select Device enrollment -> Enrollment restrictions
  4. Under Device Type Restrictions -> Default -> or choose the Custom restriction that you want to set -> Properties -> Select platforms
  5. Choose Block for Windows (MDM) to restrict personal Windows devices from accessing corp resources

Note -> This restriction policy is NOT applicable for Intune PCInstall Agent. More details available in the video tutorial.

Block Personal Windows Devices

[Related PostDifference Between Intune Enrollment Restriction and Device Restriction Profile]

End User Experience- Personal Windows Device Block

I used Windows 1803 to test the block options of personal Windows device enrollment. I had different experiences when I enrolled personal Windows devices. I was not able to get a stable experience. More details available in the video tutorial Block Personal Windows Devices.

  1. Logged in with Local Account (or personal outlook.com account) Windows 10 device
  2. Add Work or School Account from Windows Settings
  3. Enter your corp ID & password to enroll the personal Windows device into Intune

I tried enrolling three to four (3-4) Windows devices, but I had different experiences with each enrollment. I have seen a post from Per, and he has a different experience with error 80180014.

Block Personal Windows Devices

Intune Admin Experience – Personal Windows Device Block

Even though Windows personal device is enrolled successfully, the device won’t be available or visible in Intune – Devices blade. However, the device will be visible in the Azure AD devices blade.

The device record won’t get created in Intune – Devices. But it will show up in Azure AD Devices blade as AAD registered device. More details available in the video tutorial Block Personal Windows Devices.

Block Personal Windows Device

Requirement – Blocking Personal Windows devices

I would recommend reading the requirements for blocking Windows personal devices via Intune. Following is the list of requirements for Windows personal devices.

If you block personally owned Windows devices from enrollment, Intune checks to make sure that each new Windows enrollment request has been authorized as a corporate enrollment. Unauthorized enrollments will be blocked.

The following methods qualify as being authorized as a Windows corporate enrollment:

The following enrollments are marked as corporate by Intune, but since they do not offer the Intune administrator per-device control, they will be blocked:

The following personal enrollment methods will also be blocked:

* These won’t be blocked if registered with Autopilot.

Resources

Intune Windows device enrollment restrictions from Per

How to check and Change enrollment restriction priority

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.