What this check looks at
Checks that the default enrolment restriction blocks personally owned devices from enrolling in Intune, on every platform the organisation does not block outright.
Intune’s device platform restrictions decide which devices may enrol. The default restriction, All users, applies to everyone not covered by a higher-priority restriction, and out of the box it allows personally owned devices on every platform. Any user with an Intune licence can therefore enrol their own phone, tablet or home computer through Company Portal.
This check reads the default restriction for Windows, iOS/iPadOS, Android Enterprise (work profile), Android device administrator and macOS. The check fails when any of those platforms is allowed and also allows personally owned devices; a platform blocked outright, or with personal devices blocked, is fine. It warns when no platform is known to allow personal devices but the setting for some was not returned.
A device that enrols counts as managed, and usually as compliant, so Conditional Access policies that require a compliant device let it in. If anyone can enrol any device, a managed device no longer means one the organisation chose, owns and can wipe, but any device someone decided to enrol, including a family PC. Android device administrator is deprecated by Google and Microsoft, and personal Windows enrolment gives the organisation management of someone’s own computer, which few want.
Why it matters
An enrolled device counts as managed, and often as compliant, so it can reach company data under Conditional Access. If anyone can enrol a personal phone or laptop, "managed device" stops meaning a device the organisation chose and controls.
At a 50-person marketing agency, staff enrol their home Windows PCs to get past the compliant-device requirement for Teams and SharePoint. One PC is shared with a teenager who installs cracked games; it passes compliance because Defender is technically on, and an information stealer copies the synced client folders and the user’s saved passwords.
Blocking personal enrolment keeps the compliant-device control meaningful, while personal phones can still be used safely through app protection policies, which protect company data in Outlook, Teams and OneDrive without taking over the phone.
CIS Microsoft 365 Foundations Benchmark 4.2 asks for enrolment of personally owned devices to be blocked by default. CIS Controls v8 safeguard 4.1, ISO 27001 A.8.1 and A.5.9, the NCSC 10 Steps asset management guidance and the NCSC CAF device management outcome expect the organisation to control which devices are managed. NIST CSF PR.AA-05 covers access permissions being defined and enforced.
How to fix it
Where: Intune admin centre → Devices → Enrolment → Device platform restriction
Before you start
- Register company devices as corporate (Windows Autopilot, Apple Business Manager, Android Enterprise corporate enrolment, or device identifiers) so they can still enrol.
- Put app protection policies in place for personal phones before blocking their enrolment.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Agree the approach to personal devices. Agree with the client how personal devices will be handled: usually personal phones reach Outlook and Teams through app protection policies, and personal computers get browser-only access or none. Write the decision down, because it changes what staff can do.
- Make sure company devices count as corporate. Check every company device will still be allowed: Windows devices registered in Windows Autopilot or added as corporate device identifiers (Devices > Enrolment), hybrid joined PCs that enrol through Group Policy, iPhones, iPads and Macs bought through Apple Business Manager with automated device enrolment, and Android phones set up as fully managed or corporate-owned work profile. A Windows laptop joined from the setup screens without Autopilot or a corporate identifier may be treated as personal and refused.
- Put app protection in place for personal phones. In Apps > Protection, create iOS/iPadOS and Android app protection policies for Outlook, Teams, OneDrive and the Office apps, and in the Microsoft Entra admin centre a Conditional Access policy for iOS and Android requiring Require app protection policy. Do this before blocking, so people with personal phones keep a supported route to their mail.
- Block personal devices in the default restriction. In the Microsoft Intune admin centre, go to Devices > Enrolment > Device platform restriction. On each platform tab (Windows, iOS/iPadOS, Android, macOS), open the All Users default restriction, select Properties > Platform settings > Edit, and set Personally owned devices to Block for Windows, iOS/iPadOS, Android Enterprise (work profile) and macOS. Set Android device administrator to Block as a platform. Review and save each one.
- Check higher-priority restrictions. If the tenant has custom device platform restrictions above the default, review each one. A custom restriction that allows personal devices for a group still lets that group enrol them, so keep such restrictions only for a documented exception.
- Tell users and test. Tell staff that personal devices can no longer enrol and how to use the protected apps instead. With a test account, try to enrol a personal phone through Company Portal: it should be refused, while a corporate device still enrols.
- Confirm the default restriction. Reopen the All Users default restriction on each platform tab and check Personally owned devices shows Block, or the platform itself is blocked. The finding clears at the next assessment.
What users will notice
Personal phones and computers can no longer enrol in Intune; company devices enrol as before. Personal phones reach email and Teams through protected apps instead.
How to confirm it worked
Intune admin centre → Devices → Enrolment → Device platform restriction → All users shows Personally owned: Block for every platform.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | AM-1 Track asset inventory and their risks |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices3.4.1 Establish and maintain baseline configurations and inventories |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access ControlCM.L2-3.4.1 System Baselining |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.5.9 Inventory of information and other associated assets |
| CIS M365 | 4.2 Ensure device enrollment for personally owned devices is blocked by default |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Asset managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Device platform restrictions in Intune (Microsoft Learn)