This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 48%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Hi,
What are the ways to stop personal devices from enrolling to Intune. I checked and found out adding serial number as corporate device, but thats not feasable for a big company.
Have you considered using device platform restrictions to block enrollment of personal devices?
Hi Rahul, Thanks for replying.
Even if I enable that settings , how will the Intune know that this is a personal device and nor a corporate device ?
@Rishineken Pongen Thanks for posting in our Q&A.
To block enroll personal devices, please configure "Personal owned" to "Block" under Devices > Enroll devices > Enrollment device platform restrictions in intune portal.
Hope it will help.
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Could you confirm if there has been any testing done after enabling this ? How would Intune identify its a personal device and not a corporate device ? Some personal device might have home or pro version of windows
@Rishineken Pongen Based on my understanding, it is not needed to distinguish personal devices and corporate devices before enrolling them to intune. Different enrollment methods will make the devices have different ownerships.
For example, if you use BYOD enrollment method to enroll a windows device, it will show personal. If you use autopilot enrollment method to enroll a windows device, it will show corporate.
Then your solution will block all devices which aren't autopiloted. Wouldn't it ?
@Rishineken Pongen No, my solution only block BYOD enrollment because BYOD enrollment will make the device show personal.
If I have a windows 11 pro laptop personal and I first register it with Azure AD by going to access work or school account and then it prompts me to switch user and sign in with work email address and I do that. What would it make the device be registered as ?
@Rishineken Pongen Honestly, I don't have windows 11 pro device, so I can't do the test. Based on my understanding, if we set "block personal device", the device can't be enrolled to intune via going to access work or school account > click on ""connect" and sign in with work email account directly.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 78%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMB%3C/text%3E%3C/svg%3E)
To use enrollment restrictions to block personal devices, you need Autopilot in your environment. Otherwise, Entra ID will block both BYOD and Entra ID joined devices, because it only considers Autopilot provisioned devices as corporate.