Contributed by jeremy finneyAll contributors →
Part of CIS · Intune · Device enrollment · All checks
```powershell title="Run this check" Invoke-Maester -TestId CIS.M365.4.2 ``` ## Overview 4.2 (L1) Ensure device enrollment for personally owned devices is blocked by default Device enrollment restrictions let you restrict devices from enrolling in Intune based on certain device attributes such as device limit, device platform, OS Version, manufacturer or device ownership (Personally owned devices). The recommended state is to **Block** personally owned devices from enrollment. #### Rationale Restricting the enrollment of personally owned devices prevents attackers who have bypassed other controls from registering a new device to gain an additional foothold, further hiding or obscuring their activities. An attack path could be: 1. Account Compromise via Phishing and AiTM 2. Conditional Access Bypass 3. Reconnaissance using e.g. ROADrecon, GraphRunner or AADInternals 4. Lateral Movement, Privilege Escalation or Persistence through a newly registered device enrolled in Intune #### Impact Per platform personally owned device enrollment impacts are listed below. It is important to test the changes to the defaults prior to moving into production and implementing this control. **Windows Devices** The following enrollment methods are authorized for corporate enrollment for Windows devices, any other enrollment method will be considered "Personal" and blocked: * The device enrolls through Windows Autopilot. * The device enrolls through GPO, or automatic enrollment from Configuration Manager for co-management. * The device enrolls through a bulk provisioning package. * The enrolling user is using a device enrollment manager account. **MacOS** By default, Intune classifies macOS devices as personally owned. To be classified as corporate-owned, a Mac must fulfill one of the following conditions: * Registered with a serial number. * Enrolled via Apple Automated Device Enrollment (ADE). **iOS/IPadOS devices** By default, Intune classifies iOS/iPadOS devices as personally owned. To be classified as corporate-owned, an iOS/iPadOS device must fulfill one of the following conditions: * Registered with a serial number or IMEI. * Enrolled by using Automated Device Enrollment (formerly Device Enrollment Program). **Android devices** By default, until you manually make changes in the admin center, your Android Enterprise work profile device settings and Android device administrator device settings are the same. If you block Android Enterprise work profile enrollment on personal devices, only corporate-owned devices can enroll with personally owned work profiles. #### Remediation action 1. Navigate to [Microsoft Intune admin center](https://intune.microsoft.com) 2. Select **Devices** and then under **Device onboarding** click **Enrollment** 3. Under Enrollment options select **Device platform restriction**. 4. Inspect the policies listed under **Device type restrictions**: * For the **Default** priority policy, click **All Users**. * Select **Properties**. 5. Click **Edit** to change **Platform settings**. 6. In the **Personally owned** column set each platform to **Block**. >Note: Blocking platforms that are not used in the organization is a more restrictive best practice and will also effectively block enrollment of personally owned devices for the selected platform, ensuring compliance for this recommendation. #### Related links * [Microsoft Intune admin center - Enrollment restrictions](https://intune.microsoft.com/#view/Microsoft_Intune_Enrollment/EnrollmentRestrictionsMenuBlade/~/overview) * [Set enrollment restrictions in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/enrollment/enrollment-restrictions-set) * [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 4.2](https://www.cisecurity.org/benchmark/microsoft_365) ## Details