What this check looks at
Checks whether every user can join devices to Entra ID, or only selected people.
Microsoft Entra join makes a Windows device part of the tenant: people sign in to it with their work account, it receives Intune policy, and Conditional Access can treat it as a known device. The device setting Users may join devices to Microsoft Entra decides who can do this: All (Microsoft’s default), Selected users and groups, or None. Registering a personal device is a separate setting and is not affected.
The check passes when joining is limited to selected users or groups, or to nobody, and fails when every user can join devices. It reports that it could not check if the setting came back in a form it could not read.
A joined device is trusted. When anyone can join one, an attacker holding a single stolen password can join their own machine and appear in the tenant as a corporate device, one step from meeting device-based access rules. Staff can also join home PCs, which then hold company data and receive company policy without IT ever knowing.
Why it matters
A joined device becomes a trusted part of the tenant. When anyone can join one, an attacker with a single password can register their own machine and use it to satisfy device-based access policies.
In practice, uncontrolled joins fill the device list with personal PCs, laptops joined once and forgotten, and the devices of people who have left. Each holds a cached copy of someone’s mail and OneDrive, and none is in the asset inventory, so a lost one may never be reported or wiped.
Limiting joins to IT, or to Windows Autopilot, keeps the estate to machines the organisation bought, built and can wipe. It also keeps the device count meaningful for licensing and for Cyber Essentials, where every device that reaches company data is in scope.
The CIS Microsoft 365 Foundations Benchmark (5.1.4.1) asks for joining devices to Entra ID to be restricted, and Cyber Essentials requires an organisation to know and control the devices in scope. The rule maps to NIST CSF 2.0 PR.AA-01.
How to fix it
Where: Entra admin centre → Devices → Device settings
Before you start
- Create or choose the group of people allowed to join devices (normally IT). Windows Autopilot in user-driven mode joins with the person’s own account, so include everyone who sets up their own device; self-deploying and pre-provisioned Autopilot devices are not affected.
Step by step
- Check how devices are joined today. In the Microsoft Entra admin centre, go to Entra ID > Devices > All devices, filter Join type on Microsoft Entra joined, and look at who owns the recent devices. Find out whether IT builds every laptop or staff set up their own through Windows Autopilot in user-driven mode; in that mode the device is joined with the person’s own account, so those people need to be allowed to join.
- Create the group allowed to join. Go to Entra ID > Groups > All groups > New group and create a security group such as "Device joiners" holding the IT staff who build devices, plus anyone who sets up their own device through user-driven Autopilot. Autopilot self-deploying and pre-provisioned devices join without a user’s account and are not affected.
- Restrict who may join. Go to Entra ID > Devices > Device settings. Under Users may join devices to Microsoft Entra, choose Selected, select the link that appears, add the group and select Save.
- Tell the people affected. Tell staff outside the group that they can no longer join a Windows device themselves, and how new or rebuilt devices will be set up. Registering a personal device, and signing in to apps, are unaffected.
- Confirm. Reload Device settings and check Users may join devices to Microsoft Entra shows Selected with the right group. If you have a spare test device, a join by an account outside the group should be refused. Re-run the assessment to confirm.
What users will notice
People outside the group can no longer join a Windows device to Entra ID themselves; registering a personal device is unaffected.
How to confirm it worked
Entra admin centre, Devices, Device settings: "Users may join devices to Microsoft Entra" shows Selected with the right group.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.5.15 Access control |
| CIS M365 | 5.1.4.1 Ensure the ability to join devices to Entra is restricted |
| CIS Controls v8.1 | 1.2 Address unauthorized assets (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Asset managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage device identities (Microsoft Learn)