CIS.M365.5.1.4.1 - (L2) Ensure the ability to join devices to Entra is restricted
Overview
5.1.4.1 (L2) Ensure the ability to join devices to Entra is restricted
This setting enables you to select the users who can register their devices as Microsoft Entra joined devices.
The recommended state is Selected or None.
Note: This setting is applicable only to Microsoft Entra join on Windows 10 or newer. This setting doesn't apply to Microsoft Entra hybrid joined devices, Microsoft Entra joined VMs in Azure, or Microsoft Entra joined devices that use Windows Autopilot self-deployment mode because these methods work in a userless context.
Rationale
If a threat actor compromises a standard user account, they can enroll a rogue device under that user's identity. This device may inherit MDM policies and appear compliant, giving attackers persistent access to cloud resources without triggering MFA.
In a 2023 blog, Microsoft IR reports that it has detected threat actors registering their own devices to the Microsoft Entra tenant, giving them a platform to escalate the cyberattack. While simply joining a device to a Microsoft Entra tenant may present limited immediate risk, it could allow a threat actor to establish a foothold in the environment.
Impact
Restricting the setting requires IT teams to assign enrollment permissions to specific staff, such as helpdesk or provisioning personnel, which may impact user-driven Autopilot scenarios and increase administrative overhead for device onboarding and support.
Remediation action
- Navigate to Microsoft Entra admin center.
- Expand Entra ID > Devices and select Device settings.
- Set Users may join devices to Microsoft Entra to Selected (and add members) or None.
Related links
- Microsoft Entra admin center - Device settings
- Manage device identities by using the Microsoft Entra admin center
- Microsoft Incident Response lessons on preventing cloud identity compromise
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.4.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.1.4.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Device identity |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.005 Device Registration |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.4.1 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.1.4.1, nist-800-53-r5:IA-3 |
| PowerShell test | Test-MtCisEntraJoinRestricted |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.1.4.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.1.4.1.md