What this check looks at
Checks the maximum number of devices one person can join or register in Entra ID: CIS asks for 20 or fewer.
Entra ID limits how many devices one person can have joined or registered, through the setting Maximum number of devices per user. Microsoft’s default is 50, and it can be set as high as Unlimited. Microsoft Entra hybrid joined devices do not count towards it.
The check passes when the limit is between 1 and 20, and fails when it is higher than 20 or unlimited (which Microsoft Graph reports as 0).
A high limit lets one account register device after device. Each registration is a new device identity in the tenant that can hold sign-in tokens; an attacker with a compromised account can add several to keep a foothold, and a faulty script can fill the directory with stale objects. Few people genuinely use more than five or six devices.
Why it matters
A high device limit lets one compromised account register device after device, each a new foothold. A limit near what people really use contains it without getting in anyone’s way.
Attackers who phish a session sometimes register a device of their own to obtain a long-lived sign-in token, which keeps them signed in after a password reset and makes their sign-ins look like an ordinary company machine. A limit close to real use means a compromised account cannot quietly add many, and an attempt to exceed it fails with an error someone can notice.
A tidy device list matters day to day too: stale and duplicate devices make compliance reports, BitLocker key recovery and licence counts harder to trust. The limit costs almost nothing; a person who reaches it has an old device removed.
The CIS Microsoft 365 Foundations Benchmark (5.1.4.2) asks for a maximum of 20 devices per user or fewer. The rule maps to NIST CSF 2.0 PR.AA-01.
How to fix it
Where: Entra admin centre → Devices → Device settings
Before you start
- Check the Devices list for anyone near 20 devices (often test or shared accounts) and clean up stale devices first.
Step by step
- Check who is near the limit. In the Microsoft Entra admin centre, go to Entra ID > Devices > All devices and select Download devices. Count the devices per owner in the downloaded file: test, shared and service accounts are the usual ones near 20.
- Clean up stale devices first. Disable, and later delete, devices that have not signed in for months (see the Activity column) and duplicates left by re-imaging, after checking none holds a BitLocker recovery key you still need.
- Set the limit. Go to Entra ID > Devices > Device settings. Set Maximum number of devices per user to 20 (or 10 if the client prefers) and select Save.
- Brief the service desk. Tell the service desk that a person at the limit gets an error when joining or registering another device, and that the fix is to remove one of their old devices, not to raise the limit.
- Confirm. Reload Device settings and check the limit shows 20 or fewer. Re-run the assessment to confirm the finding passes.
What users will notice
A person who already has 20 devices joined or registered cannot add another until an old one is removed.
How to confirm it worked
Entra admin centre, Devices, Device settings: "Maximum number of devices per user" is 20 or fewer.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | AM-1 Track asset inventory and their risks |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.1 User endpoint devices |
| CIS M365 | 5.1.4.2 Ensure the maximum number of devices per user is limited |
| CIS Controls v8.1 | 1.2 Address unauthorized assets (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Device settings (Microsoft Learn)