Skip to main content
Version: 3.0.0-preview

CIS.M365.4.2 - (L1) Ensure device enrollment for personally owned devices is blocked by default

jeremy finney
Contributed by jeremy finneyAll contributors →

Overview​

4.2 (L1) Ensure device enrollment for personally owned devices is blocked by default

Device enrollment restrictions let you restrict devices from enrolling in Intune based on certain device attributes such as device limit, device platform, OS Version, manufacturer or device ownership (Personally owned devices).

The recommended state is to Block personally owned devices from enrollment.

Rationale​

Restricting the enrollment of personally owned devices prevents attackers who have bypassed other controls from registering a new device to gain an additional foothold, further hiding or obscuring their activities.

An attack path could be:

  1. Account Compromise via Phishing and AiTM
  2. Conditional Access Bypass
  3. Reconnaissance using e.g. ROADrecon, GraphRunner or AADInternals
  4. Lateral Movement, Privilege Escalation or Persistence through a newly registered device enrolled in Intune

Impact​

Per platform personally owned device enrollment impacts are listed below. It is important to test the changes to the defaults prior to moving into production and implementing this control.

Windows Devices The following enrollment methods are authorized for corporate enrollment for Windows devices, any other enrollment method will be considered "Personal" and blocked:

  • The device enrolls through Windows Autopilot.
  • The device enrolls through GPO, or automatic enrollment from Configuration Manager for co-management.
  • The device enrolls through a bulk provisioning package.
  • The enrolling user is using a device enrollment manager account.

MacOS By default, Intune classifies macOS devices as personally owned. To be classified as corporate-owned, a Mac must fulfill one of the following conditions:

  • Registered with a serial number.
  • Enrolled via Apple Automated Device Enrollment (ADE).

iOS/IPadOS devices By default, Intune classifies iOS/iPadOS devices as personally owned. To be classified as corporate-owned, an iOS/iPadOS device must fulfill one of the following conditions:

  • Registered with a serial number or IMEI.
  • Enrolled by using Automated Device Enrollment (formerly Device Enrollment Program).

Android devices By default, until you manually make changes in the admin center, your Android Enterprise work profile device settings and Android device administrator device settings are the same.

If you block Android Enterprise work profile enrollment on personal devices, only corporate-owned devices can enroll with personally owned work profiles.

Remediation action​

  1. Navigate to Microsoft Intune admin center
  2. Select Devices and then under Device onboarding click Enrollment
  3. Under Enrollment options select Device platform restriction.
  4. Inspect the policies listed under Device type restrictions:
    • For the Default priority policy, click All Users.
    • Select Properties.
  5. Click Edit to change Platform settings.
  6. In the Personally owned column set each platform to Block.

Note: Blocking platforms that are not used in the organization is a more restrictive best practice and will also effectively block enrollment of personally owned devices for the selected platform, ensuring compliance for this recommendation.

Test Metadata​

FieldValue
Test IDCIS.M365.4.2
SeverityMedium
SuiteCIS
ProductIntune
FeatureDevice enrollment
AreaDevices and endpoints
Resource typeTenant
User impactMedium
Implementation costLow
MITRE ATT&CKT1098.005 Device Registration
Supports benchmarkCIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 4.2
Benchmark levelL1
Benchmark profilesE3 Level 1
Supports controlscis-m365:4.2, nist-800-53-r5:AC-19
PowerShell testTest-MtCisPersonalDeviceEnrollmentBlocked
ServicesGraph
Compatible licensesINTUNE_A

Source​