Restrict device join to selected users/groups or none

Contributed by Marcel N.All contributors →

Part of Maester · Entra ID · Device identity · All checks

Run this check

Invoke-Maester -TestId MT.1070

Overview

Description

Verifies that device join to Entra ID is restricted to selected users/groups or disabled entirely.

Why This Matters

Device join should be restricted because:

• Unauthorized Access: Unrestricted device join allows any user to connect personal or unmanaged devices to corporate resources.
• Data Leakage: Uncontrolled devices may not have proper security controls, increasing risk of data exposure.
• Compliance: Many regulatory frameworks require controlled device access to organizational resources.
• Shadow IT: Unmanaged devices bypass security policies and monitoring capabilities.
• Attack Surface: Each joined device represents a potential entry point for attackers.

Restricting device join to selected users/groups ensures only authorized devices with proper security controls can access organizational resources.

Remediation action

This setting can be changed via device settings in the Microsoft Entra or Azure portal or via Microsoft Graph API / Graph PowerShell Module.

Admin Portal:

1. Go to Entra Admin Center
2. Navigate to Devices → Device settings
3. Set Users may join devices to Microsoft Entra to Selected or None
   • If Selected, configure the specific users/groups that can join devices
   • If None, disable device join entirely
4. Click Save

Use the following PowerShell commands to restrict device join:

# Connect to Microsoft Graph with appropriate permissions
Connect-MgGraph -Scopes "Policy.ReadWrite.DeviceConfiguration"

# Option 1: Disable device join completely
$params = @{
    azureADJoin = @{
        allowedToJoin = @{
            "@odata.type" = "#microsoft.graph.noDeviceRegistrationMembership"
        }
    }
}

# Option 2: Restrict to selected users/groups
$params = @{
    azureADJoin = @{
        allowedToJoin = @{
            "@odata.type" = "#microsoft.graph.enumeratedDeviceRegistrationMembership"
            users = @("[email protected]", "[email protected]")
            groups = @("group-id-1", "group-id-2")
        }
    }
}

# Apply the policy
Update-MgPolicyDeviceRegistrationPolicy -BodyParameter $params

Related links

• Manage device identities in Entra ID
• Device registration policy in Entra ID

Details

Every attribute of this check

Field	Value
Test ID	MT.1070
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Device identity
Area	Devices and endpoints
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.005 Device Registration
Supports controls	nist-800-53-r5:AC-6, nist-800-53-r5:IA-3
PowerShell test	Test-MtEntraDeviceJoinRestricted
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1070.ps1
• Documentation: tests/maester/entra/Test.MT.1070.md