Let’s discuss the Differences Between the Intune Enrollment Restriction and Device Restriction Profile. I was going through one of the TechNet documents and got confused between enrollment restriction policies and device restriction policies. I have posted about both of these policies.
In the post-Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices, you will learn everything you need to create device restriction policy profiles in Intune and deploy security policies to Windows 10 devices. We will guide you step-by-step through setting up these policies to ensure your devices are secure and comply with your organization’s requirements.
How to Restrict Personal Android Devices from Enrolling into Intune post helps you to provide detailed instructions on restricting personal Android devices from enrolling into Intune using Endpoint Manager (MEM). It covers the steps necessary to configure enrollment restrictions, ensuring that only corporate-owned devices can be enrolled and managed through Intune.
Device restrictions are entirely different from Enrollment restrictions. Both options have different use cases, which will be explained in this post. These two policies are used in modern device management solutions like Intune and Azure AD.
- Video Experience Intune Device Restriction Policy Deployment to Windows 10 Device
- How to Restrict Personal Android Devices from Enrolling on Intune
Table of Contents
Differences Between Intune Enrollment Restriction Device Restriction Profile – Enrollment Device Platform Restrictions
Intune Device restriction profiles (Enrollment Device Platform Restrictions) are policies similar to GPO from the traditional device management world. Most enterprise organizations use GPO to restrict corporate-owned devices.
These are security policies that need to be applied to devices. Intune Device restriction policies control various mobile device settings and features (iOS, Android, macOS, and Windows 10).
- MDM – Allow or Block
- Allow – min/max range
- Personally owned devices – Allow or Block
Device Type Restriction in Intune
Enrollment device platform restrictions make more sense. Navigate to Devices – Enroll Devices – Enrollment Device Platform Restrictions.
This type of policy could apply to different categories, including security, browser, hardware, and data-sharing settings. For example, you could create a device restriction profile policy that prevents Windows users from sharing the internet or using Cortana, etc.
Intune Device Restriction profiles can be deployed to specific users/devices in AAD groups, whereas Intune Enrolment restriction policies can’t be deployed to specific user/device groups in Azure AD. The following section of this post provides more details.
Intune Device Limit Restrictions
Enrollment is the first part of Mobile Device Management (MDM). Why do we need to enroll a mobile device into Intune? Enrollment is the first step for management. When a device is enrolled in Intune, they have issued an MDM certificate, which that device then uses to communicate with the Intune service.
In several scenarios, we need to block employees from enrolling their devices in the corporate management platform. You want to block devices not secured enough to enroll in Intune, such as personal devices.
Also, we could block devices with lower OS versions. How is this possible from Intune? Difference Between Intune Enrollment Restriction Device Restriction Profile | Configuration Manager ConfigMgr.
Navigate to Microsoft Intune—Enroll Devices—Enrollment device limit restrictions. You will see two Intune enrollment restriction policies.
Intune Enrollment Restriction Policies |
---|
Device Type Restrictions |
Device Limit Restrictions |
Device Type restriction is where we can define which platforms, versions, and management types can enroll. So, all other devices are blocked from Intune enrollment.
The only problem with Intune enrollment restrictions I can think of is that device type restrictions in Intune are deployed to “All Users, ” we can’t deploy or assign Intune enrollment restriction policies to “specific user group.” At the moment, the device type restrictions policies are tenant-wide configurations.
Device Limit Restrictions in Intune
Navigate to Enroll Devices – Enrollment Device Limit Restrictions to configure the limitation.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Hi Anoop,
I have setup a POC lab for SCCM and Intune Integration. Everything is working great up to the point where I want to enroll devices.
I have setup everything that needs to be done from SCCM and Intune perspective. When I view the Platforms Configuration under the default Device Type Restriction Policy located here:
Home > Microsoft Intune > Device enrollment – Enrollment restrictions > All Users – Platforms Configuration
It tells me:
All device platforms are blocked. Allow platform enrollment to enable platform configuration.
So I go to edit the platforms section to edit the default Device Type Restrictions, allow android enrollment and then save the configuration I get an error and the policy wont save. How can I enable Android enrollment if the policy wont save?
An error occurred.
14:55
An error occurred while saving. Request ID: 59ea85b9-c6a2-4f71-b1ea-879dfb8d1d73
Thanks in advance.
Tom.