Limit the maximum number of devices per user to 10
Overview
Section titled “Overview”Controlling device proliferation is important. Set a reasonable limit on the number of devices each user can register in your Microsoft Entra ID tenant. Limiting device registration maintains security while allowing business flexibility. Microsoft Entra ID lets users register up to 50 devices by default. Reducing this number to 10 minimizes the attack surface and simplifies device management.
Remediation
Section titled “Remediation”- Learn how to limit the maximum number of devices per user.
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Device management |
| Product | Entra ID |
| Feature | Device identity |
| Area | Devices and endpoints |
| ATT&CK | T1098.005 Device Registration |
| Licence | Free |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.