Prevent users from Joining personal computers to Azure Active Directory but still allow User-Driven Autopilot

Todd Anderson 36

My company allows users to register personal computers with our AAD. We also provide corporate computers and use user-driven Autopilot to provision them. The challenge we found is that since users are admin on their personal computers they have the ability to Join a personal computer to AAD from Settings>Accounts>Access Work or School>Connect using the Join to AAD link. When they join the device it is considered company owned by default and when it auto enrolls to Intune it receives all the corporate device assigned apps and policies etc.

We would like to prevent users from Joining to AAD and only allow them to register personal devices but without breaking the ability to use User-driven Autopilot. We tried restricting the "Allow users to join AAD" to only IT support but this breaks user-driven Autopilot.

The only way that I can currently think to achieve this is to use Autopilot for pre-provisioned deployment and could then disallow the main user base from joining devices to AAD but we don't want to do this for general provisioning.

Anyone know of some secret sauce to achieve this?

Todd Anderson 36 Reputation points

2021-12-10T17:00:18.247+00:00

Feels like there should be a setting that restricts how devices can be joined by users. Like only during Autopilot for instance.
Ben Owens 1 Reputation point

2022-04-06T11:09:47.93+00:00

Any success in finding a way to achieve this?

The way I see it currently see it....

To allow Autopilot user driven mode, the "Users may join devices to Azure AD" needs to be set to 'All' or at least the people you want to allow to complete Autopilot user driven deployments.

You can set-up enrolment restrictions to stop personal devices being enrolled. That would only allow enrolment of device listed in Corporate Device Identifiers in Intune, device registered and enrolled via Autopilot, or enrolment via Hybrid Azure AD Join.

However, that leaves a gap where a user could Azure AD Join a device, but not enrolled in Intune. You could have conditional access policies in place to require devices are Compliant to access resources; that plugs a security gap. But apart from that, I imagine a periodic administrative task would be required to cross reference Autopilot registered serial numbers against Azure AD joined device serial numbers. The serial numbers which are not registered in Autopilot would suggest they're personal devices joined to Azure AD and should be removed from Azure AD. Not exactly seamless. Anybody have a different suggestion?
Simon Payne 6 Reputation points

2022-04-06T22:04:54.48+00:00

If you have auto-enrollment enable, any attempted to join a PC to azure AD will fail if personal devices are denied to enrol as it seems to combine the AADJ with the enrolment. When it gets to enrolment it fails but therefore also seems to fail the AADJ.
Seemed to be sufficient for me
Ben Owens 1 Reputation point

2022-04-06T22:11:26.82+00:00

Interesting, I'll have to check out that behaviour.

On a side note, it looks like you could use the new device filters in conditional access policy to determine if a device is registered in autopilot. You could potentially restrict that way.

It's the same dynamic query you would use for the the autopilot dynamic group. I'll report back after testing.
Simon Payne 6 Reputation points

2022-04-07T22:55:16.127+00:00

@Todd Anderson - does this work for you?

4 answers

Mr Sb 366 Reputation points

2021-12-11T00:25:10.943+00:00

There are several ways to do this but imo I would suggest to use enrollment restrictions if you don't want users to enroll personal devices in Intune.

https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set
Please sign in to rate this answer.

1 person found this answer helpful.
Todd Anderson 36 Reputation points

2021-12-11T02:12:30.963+00:00

Thanks for the response. Enrollment restrictions only applies to Intune enrollment correct? If a user manually joins a personal device to AAD it is treated as a Company device and enrollment restrictions would not recognize it as a personal device, as far as I understand and have seen. We actually don’t want to restrict enrollment into intune but restrict join of personal devices to AAD.

Mr Sb 366 Reputation points

2021-12-11T10:17:27.857+00:00

We use a group to restrict the AAD join so that only Autopilot users can join their device in AAD.

Todd Anderson 36 Reputation points

2021-12-11T15:45:25.637+00:00

Well this would be great. What do you apply to the group to restrict the join to only Autopilot?

Mr Sb 366 Reputation points

2021-12-15T10:50:27.253+00:00

We only add users to the group that have an autopilot device. Unfortunately, there is no option to allow only for autopilot devices.

JamesTran-MSFT 36,656 Reputation points Microsoft Employee

2022-01-25T18:22:39.8+00:00

@Todd Anderson
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Jon Budnik 1 Reputation point

2022-02-07T15:48:47.153+00:00

This option is close, however all of the autopilot users still have the ability to register their personal computers to Azure AD correct?

Todd Anderson 36 Reputation points

2022-06-29T19:52:01.157+00:00

@JamesTran-MSFT
Nothing going yet. Was reminded today about this issue when someone accidentally joined their new personal computer to our AAD, enrolled into Intune and auto registered into our Autopilot. Then when the user tried to reset it and set it back up she no longer had the option to choose Personal since its in our Autopilot. User had to call our help desk and issue eventually got escalated and autopilot registration removed etc.. Doesn't happen often but is not great that we can't prevent it.

Really seems we need another option/setting to restrict users from joining a device to AAD unless it is during the Autopilot process.

Ben Owens 1 Reputation point

2022-06-30T18:12:44.077+00:00

Could you confirm the settings you have in place for this.

I have revisited this in the lab and have Enrolment Device Restriction set to Disable enrolment of 'Personal' devices. With that in place, on a BYOD Windows device, I cannot get a device to join using AADJ only via Access Work and School or using the main connect option in Access Work and School. In both cases it fails.

However, when I upload the hardware hash of the BYOD to autopilot registered devices, the joining of the BYOD devices works; that's because it's now registered as an autopilot device and recognised as corporate.

What are your Enrolment Device Restrictions settings in Intune set to for Windows devices?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Simon Payne 6 Reputation points

2022-03-09T01:35:48.827+00:00

Did this every get solved?
I too would like users to use autopilot but block them from joining personal devices to AAD
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Simon Payne 6 Reputation points

2022-03-09T01:43:17.837+00:00

I can see the restriction does not apply to Autopilot in self deployment mode but we wish to use user-driven mode
Please sign in to rate this answer.
Todd Anderson 36 Reputation points

2022-04-07T15:12:37.183+00:00

Yeah can confirm this does break User-Driven Autopilot
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Pixl Pixl 1 Reputation point

2022-12-12T12:05:14.397+00:00

@Todd Anderson Will this option also cause issues with Windows Autopilot Hybrid Join -User Driven , if it is set to None
Please sign in to rate this answer.
Ben Owens 1 Reputation point

2022-12-12T12:12:47.99+00:00

Yes, my understanding is that setting it to None will stop people from completing HAADJ user driven autopilot deployments.

Paul Isaac 6 Reputation points

2023-06-28T18:45:15.4566667+00:00

I would have to agree with Ben, based on what the help blurb says: This DOES NOT apply to hybrid Azure AD joined Devices, Azure-AD joined VMs in Azure and Azure AD joined devices using Windows Autpilot self-deployment mode. What is missing here is any user driven Autopilot. This is very frustrating.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Prevent users from Joining personal computers to Azure Active Directory but still allow User-Driven Autopilot

4 answers

Your answer