Prevent users from Joining personal computers to Azure Active Directory but still allow User-Driven Autopilot

Question

question

ToddAnderson-1015 asked Dec 10, '21 BenOwens-4675 commented Jun 30, '22

Prevent users from Joining personal computers to Azure Active Directory but still allow User-Driven Autopilot

My company allows users to register personal computers with our AAD. We also provide corporate computers and use user-driven Autopilot to provision them. The challenge we found is that since users are admin on their personal computers they have the ability to Join a personal computer to AAD from Settings>Accounts>Access Work or School>Connect using the Join to AAD link. When they join the device it is considered company owned by default and when it auto enrolls to Intune it receives all the corporate device assigned apps and policies etc.

We would like to prevent users from Joining to AAD and only allow them to register personal devices but without breaking the ability to use User-driven Autopilot. We tried restricting the "Allow users to join AAD" to only IT support but this breaks user-driven Autopilot.

The only way that I can currently think to achieve this is to use Autopilot for pre-provisioned deployment and could then disallow the main user base from joining devices to AAD but we don't want to do this for general provisioning.

Anyone know of some secret sauce to achieve this?

mem-autopilot azure-ad-device-management

· 5

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ToddAnderson-1015 · Dec 10, 2021 at 05:00 PM

Feels like there should be a setting that restricts how devices can be joined by users. Like only during Autopilot for instance.

0 ·

BenOwens-4675 ToddAnderson-1015 · Apr 06 at 11:09 AM

Any success in finding a way to achieve this?

The way I see it currently see it....

To allow Autopilot user driven mode, the "Users may join devices to Azure AD" needs to be set to 'All' or at least the people you want to allow to complete Autopilot user driven deployments.

You can set-up enrolment restrictions to stop personal devices being enrolled. That would only allow enrolment of device listed in Corporate Device Identifiers in Intune, device registered and enrolled via Autopilot, or enrolment via Hybrid Azure AD Join.

However, that leaves a gap where a user could Azure AD Join a device, but not enrolled in Intune. You could have conditional access policies in place to require devices are Compliant to access resources; that plugs a security gap. But apart from that, I imagine a periodic administrative task would be required to cross reference Autopilot registered serial numbers against Azure AD joined device serial numbers. The serial numbers which are not registered in Autopilot would suggest they're personal devices joined to Azure AD and should be removed from Azure AD. Not exactly seamless. Anybody have a different suggestion?

0 ·

SimonPayne-1252 BenOwens-4675 · Apr 06 at 10:04 PM

If you have auto-enrollment enable, any attempted to join a PC to azure AD will fail if personal devices are denied to enrol as it seems to combine the AADJ with the enrolment. When it gets to enrolment it fails but therefore also seems to fail the AADJ.
Seemed to be sufficient for me

1 ·

Show more comments

Answer 1 · 2021-12-11T00:25:10.943Z

MrSbaa answered Dec 11, '21 BenOwens-4675 commented Jun 30, '22

There are several ways to do this but imo I would suggest to use enrollment restrictions if you don't want users to enroll personal devices in Intune.

https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set

· 8

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ToddAnderson-1015 · Dec 11, 2021 at 02:12 AM

Thanks for the response. Enrollment restrictions only applies to Intune enrollment correct? If a user manually joins a personal device to AAD it is treated as a Company device and enrollment restrictions would not recognize it as a personal device, as far as I understand and have seen. We actually don’t want to restrict enrollment into intune but restrict join of personal devices to AAD.

1 ·

MrSbaa ToddAnderson-1015 · Dec 11, 2021 at 10:17 AM

We use a group to restrict the AAD join so that only Autopilot users can join their device in AAD.

0 ·

ToddAnderson-1015 MrSbaa · Dec 11, 2021 at 03:45 PM

Well this would be great. What do you apply to the group to restrict the join to only Autopilot?

0 ·

Show more comments

JonBudnik-9885 MrSbaa · Feb 07 at 03:48 PM

This option is close, however all of the autopilot users still have the ability to register their personal computers to Azure AD correct?

0 ·

JamesTran-MSFT · Jan 25 at 06:22 PM

@ToddAnderson-1015
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

0 ·

ToddAnderson-1015 JamesTran-MSFT · Jun 29 at 07:52 PM

@JamesTran-MSFT
Nothing going yet. Was reminded today about this issue when someone accidentally joined their new personal computer to our AAD, enrolled into Intune and auto registered into our Autopilot. Then when the user tried to reset it and set it back up she no longer had the option to choose Personal since its in our Autopilot. User had to call our help desk and issue eventually got escalated and autopilot registration removed etc.. Doesn't happen often but is not great that we can't prevent it.

Really seems we need another option/setting to restrict users from joining a device to AAD unless it is during the Autopilot process.

1 ·

BenOwens-4675 ToddAnderson-1015 · Jun 30 at 06:12 PM

Could you confirm the settings you have in place for this.

I have revisited this in the lab and have Enrolment Device Restriction set to Disable enrolment of 'Personal' devices. With that in place, on a BYOD Windows device, I cannot get a device to join using AADJ only via Access Work and School or using the main connect option in Access Work and School. In both cases it fails.

However, when I upload the hardware hash of the BYOD to autopilot registered devices, the joining of the BYOD devices works; that's because it's now registered as an autopilot device and recognised as corporate.

What are your Enrolment Device Restrictions settings in Intune set to for Windows devices?

0 ·

Answer 2 · 2022-03-09T01:35:48.827Z

SimonPayne-7376 answered Mar 9, '22 SimonPayne-7376 published Mar 9, '22

Did this every get solved?
I too would like users to use autopilot but block them from joining personal devices to AAD

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2022-03-09T01:43:17.837Z

SimonPayne-7376 answered Mar 9, '22 ToddAnderson-1015 commented Apr 7, '22

I can see the restriction does not apply to Autopilot in self deployment mode but we wish to use user-driven mode

image.png (13.9 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ToddAnderson-1015 · Apr 07 at 03:12 PM

Yeah can confirm this does break User-Driven Autopilot

0 ·

question