What this check looks at
Finds Entra-registered or joined devices with no management agent.
A device appears in Microsoft Entra ID in one of three ways: registered (typically a personal phone or PC where someone added their work account to Outlook, Teams or Windows settings), joined (a company Windows device signed in with a work account), or hybrid joined (a domain-joined PC synchronised from Active Directory). None of these makes the device managed. Only enrolment in Intune or another MDM applies policies, reports compliance and allows a remote wipe.
This check counts the device records in Entra ID that report no management agent. The check fails when more than 10 per cent of device records are unmanaged, and warns when there are some but 10 per cent or fewer. The evidence lists examples with their operating system and join type.
An unmanaged device can hold the user’s tokens, cached mail, synced OneDrive files and Teams downloads with no requirement for disk encryption, a screen lock, current patches or antivirus, and nothing on it can be wiped when it is lost or the person leaves. Joined but unmanaged Windows PCs are a common gap where automatic MDM enrolment was never switched on, or the user has no Intune licence.
Why it matters
A joined but unmanaged device holds tokens and cached data with none of the controls — no encryption requirement, no patch enforcement, no remote wipe when it is lost.
A typical case: a 60-person charity finds that half its device records are unmanaged: staff phones registered through Outlook, and laptops joined to Entra ID before Intune was licensed. When a fundraiser leaves on bad terms, their personal phone keeps a full copy of the donor mailbox in Outlook, and with no app protection policy there is nothing the charity can remove.
Bringing company devices under Intune, and protecting personal phones with app protection policies instead of full enrolment, means every device that touches company data has either a policy or a way to remove that data. Requiring a managed device in Conditional Access then keeps the gap from reopening.
CIS Controls v8 safeguards 1.1 (asset inventory) and 1.2 (address unauthorised assets), Cyber Essentials’ secure configuration requirement, ISO 27001 A.5.9 and A.8.1, and the NCSC CAF asset management and device management outcomes expect devices that access company data to be known and controlled. NIST CSF ID.AM-01 asks for hardware inventories to be maintained.
How to fix it
Where: Entra admin centre → Identity → Devices → All devices
Before you start
- Decide whether personal devices are allowed; if so, use app protection policies instead of full enrolment for them.
Step by step
- Classify the unmanaged devices. In the Microsoft Entra admin centre, go to Entra ID > Devices > All devices, show the Join type and MDM columns, filter MDM to None (or download the list), and split it into Microsoft Entra registered (usually personal), Microsoft Entra joined and Microsoft Entra hybrid joined. Records not seen for 90 days belong in the stale device clean-up instead.
- Turn on automatic enrolment for Windows. In the Microsoft Intune admin centre, go to Devices > Enrolment (under Device onboarding), Windows tab, and open Automatic Enrolment. Set MDM user scope to All (or a group containing every licensed user) and Save, and check every user has an Intune licence. Windows devices joined from now on enrol automatically; devices already joined without MDM need enrolling from Settings > Accounts > Access work or school, or resetting through Windows Autopilot.
- Enrol hybrid joined PCs with Group Policy. For domain-joined PCs, create a Group Policy object linked to the computers’ organisational unit and enable the automatic MDM enrolment setting under Computer Configuration > Administrative Templates > Windows Components > MDM, choosing User Credential. The PCs enrol at the next policy refresh and sign-in; check they appear in Intune as managed.
- Protect personal phones with app protection. In the Intune admin centre go to Apps > Protection > Create policy, once for iOS/iPadOS and once for Android, targeting Outlook, Teams, OneDrive, Word, Excel and PowerPoint. Require a PIN, block copying to unmanaged apps and saving to personal storage, and assign to All users. This protects company data on personal phones without enrolling them, and allows a selective wipe of company data.
- Require protection in Conditional Access. In Entra ID > Conditional Access, create a policy for iOS and Android requiring Require app protection policy, and one for Windows and macOS requiring a compliant or hybrid joined device (see the device compliance Conditional Access finding). Start both in report-only mode and exclude the emergency access accounts.
- Limit unmanaged computers to the browser. For people who must use a personal computer, in the SharePoint admin centre go to Policies > Access control > Unmanaged devices and choose Allow limited, web-only access. This creates matching Conditional Access policies that use app enforced restrictions, so files can be read in the browser but not downloaded or synced.
- Remove registrations that should not exist. Disable, then later delete, Entra registered devices that belong to leavers or that nobody recognises (Entra ID > Devices > All devices > the device > Disable).
- Confirm what is left unmanaged. Filter Entra ID > Devices > All devices on MDM: None again. Company devices should all be gone from the list. Personal phones protected by app protection policies still count as unmanaged here; if they keep the share above 10 per cent, record that against the finding. Otherwise it clears at the next assessment.
What users will notice
Users enrol their device through Company Portal, or lose access from unmanaged devices once the Conditional Access policy is on.
How to confirm it worked
Entra ID, Devices: the unmanaged percentage in the evidence is falling, and new devices appear as Intune-managed.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Secure configuration |
| Cyber Essentials Plus | Secure configuration |
| NCSC CAF | A3.a Asset managementB2.b Device management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 8 Identification of ICT assets and information |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | AM-1 Track asset inventory and their risks |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 12.5.1 An inventory of in-scope system components is maintained |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices3.4.1 Establish and maintain baseline configurations and inventories |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access ControlCM.L2-3.4.1 System Baselining |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assetsA.8.1 User endpoint devices |
| CIS Controls v8.1 | 1.1 Establish and maintain a detailed enterprise asset inventory (IG1)1.2 Address unauthorized assets (IG1) |
| NIST CSF 2.0 | ID.AM-01: Inventories of hardware managed by the organization are maintained |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage devices in Entra ID (Microsoft Learn)