Intune enrollment restrictions decide which devices are allowed into your tenant in the first place. Get them wrong in one direction and a staff member’s home gaming PC ends up fully managed, receiving your apps and counting as a “compliant” device. Get them wrong in the other and you block the new hire’s laptop on day one. This guide shows how to block personal device enrollment while keeping a clean path for company devices and for people who genuinely need mobile access.
Why personal enrollment is a problem
Out of the box, Intune is permissive. If automatic enrollment is enabled and a user signs in to Windows with their work account, or taps “Allow my organization to manage my device” in an Office app, that device can end up enrolled. Once enrolled, it may pass your compliance policy and satisfy a Conditional Access rule that requires a compliant device.
That creates three issues:
Trust: “Compliant” should mean a device the business owns and controls. A personal laptop with an unknown history does not qualify, however good its antivirus status looks.
Privacy and liability: Full MDM on a personal device gives IT the ability to wipe it. Most employees do not want that, and most employers do not want the risk of wiping someone’s family photos.
Licensing and inventory: Personal devices inflate your device count, muddy asset reports and can consume device limits per user.
In the tenants I review, the most common gap is a tenant with Conditional Access requiring compliant devices and no restriction on who can become compliant. The control exists on paper, but anyone can walk through it.
How Intune decides what is personal
Blocking personal devices only works if Intune can recognise corporate ones. The rules differ by platform:
Windows: When personal enrollment is blocked, Intune only allows enrollment methods it treats as authorized for corporate use. Microsoft lists Windows Autopilot, Group Policy or Configuration Manager co-management enrollment, bulk provisioning packages and the device enrollment manager account. Company Portal enrollment, “Add work account” in Settings and enrollment triggered from a Microsoft 365 app are treated as personal and blocked.
iOS/iPadOS and macOS: Intune treats Apple devices as personal by default. They are corporate only if enrolled through Apple Automated Device Enrollment or registered with a corporate identifier such as a serial number.
Android: If you block personal Android Enterprise work profile enrollment, only corporate-owned devices can enroll, using fully managed, dedicated or corporate-owned work profile enrollment.
One Windows detail catches people out. A device joined to Microsoft Entra during Windows setup, without Autopilot, is classed as corporate but is still blocked by a personal restriction, because that method does not give the admin per-device control. If you block personal Windows devices, you need either Autopilot registration or Windows corporate identifiers (manufacturer, model and serial number) uploaded in advance.
Create the restriction
In the Microsoft Intune admin center, go to Devices > Device onboarding > Enrollment > Device platform restriction.
Choose the platform tab: Windows, Android, macOS or iOS/iPadOS.
Select Create restriction, give it a clear name such as Block personal Windows, and select Next.
On Platform settings, leave MDM on Allow and set Personally owned devices to Block. Set a minimum OS version if you want to keep outdated builds out.
Assign it to the user group it should cover. Start with a pilot group, not All users.
Review priority. Restrictions are processed in order, and a higher-priority allow policy wins over a lower block. The default restriction sits at the bottom.
Before you turn it on for everyone, check Devices > Enrollment failures during the pilot. Blocked enrollments show the reason Enrollment restriction not met, which tells you exactly who would have been affected.
Keep productivity: the paths that stay open
Blocking personal enrollment is not the same as blocking personal devices from working. The goal is to stop personal devices becoming fully managed, while still letting people read email on their own phone in a controlled way.
Scenario
Path
Control
New company Windows laptop
Windows Autopilot, registered by the reseller or OEM
Full MDM, compliance, Conditional Access
Existing company Windows laptop
Corporate identifier upload, or Autopilot registration
Full MDM
Company iPhone or iPad
Apple Automated Device Enrollment through Apple Business Manager
Supervised MDM
Company Android phone
Fully managed or corporate-owned work profile
Full MDM
Personal phone
No enrollment, app protection policy only
Data contained in Outlook, Teams, OneDrive
Personal Windows PC
Browser access with session controls, or Edge with Windows app protection
Limited, no local sync
The personal phone row is what keeps people happy. Pair the restriction with an Intune app protection policy and a Conditional Access rule that requires either a compliant device or an approved app with app protection. Staff can still use their own phone for email and Teams, but company data stays inside managed apps and can be selectively wiped.
Exceptions without a free-for-all
There will be exceptions: a director who insists on using a personal Mac, a contractor who needs a full desktop app, a test device for IT. Handle them with a second restriction that allows personal enrollment, assigned to a small, named security group, with a higher priority than the block. Microsoft recommends limiting personal Windows enrollment to only the users who need it, and that is the right instinct.
Document who is in that group and why, and review it every quarter. Exception groups have a habit of growing quietly until they include half the company.
If you use Windows 365 Link devices or other specialist hardware, Microsoft documents using an assignment filter on an allow restriction so those devices can enroll while unknown Windows devices are still blocked. The same pattern works for other edge cases where you can describe the device with a filter property.
Common mistakes
Blocking before Autopilot is ready. If your reseller is not registering devices yet, the next laptop delivery will fail enrollment. Confirm registration first.
Forgetting existing devices. Restrictions apply at enrollment time. Personal devices that enrolled last year stay enrolled. Review the device list filtered by ownership and retire what should not be there.
Not changing ownership. Devices enrolled with Windows corporate identifiers through “Add work account” can show as personal after enrollment. Check ownership in device properties and correct it where needed.
No user communication. Tell staff what is changing and how to get mobile email on a personal phone. A two-paragraph email prevents most helpdesk tickets.
Frequently asked questions
Can I block personal devices without Windows Autopilot?
Yes. You can upload Windows corporate identifiers (manufacturer, model and serial number) so those devices are treated as corporate at enrollment. Autopilot is still the cleaner option for new hardware because the reseller can register devices before they ship.
Will blocking personal enrollment stop users reading email on their phone?
Not if you plan for it. Personal phones can use Outlook and Teams protected by an Intune app protection policy without enrolling. Conditional Access can require an approved app with app protection instead of a compliant device for mobile platforms.
What licence do Intune enrollment restrictions need?
Enrollment restrictions are part of Microsoft Intune Plan 1, which is included in Microsoft 365 Business Premium, E3 and E5. Conditional Access, which makes the restriction meaningful, needs Microsoft Entra ID P1, included in the same plans.
Microsoft’s article on enrollment restrictions lists every enrollment method and how it is classified. If you are planning a rollout, see our Intune deployment service and our approach to BYOD for Microsoft 365. For a broader look at your identity controls, our MFA enablement work pairs well with device restrictions.
Want to know whether personal devices are already sitting in your Intune tenant as “compliant”? Request a free Microsoft 365 security assessment and we will show you what is enrolled and how to tighten it without disrupting staff.
Intune enrollment restrictions decide which devices are allowed into your tenant in the first place. Get them wrong in one direction and a staff member’s home gaming PC ends up fully managed, receiving your apps and counting as a “compliant” device. Get them wrong in the other and you block the new hire’s laptop on day one. This guide shows how to block personal device enrollment while keeping a clean path for company devices and for people who genuinely need mobile access.
Why personal enrollment is a problem
Out of the box, Intune is permissive. If automatic enrollment is enabled and a user signs in to Windows with their work account, or taps “Allow my organization to manage my device” in an Office app, that device can end up enrolled. Once enrolled, it may pass your compliance policy and satisfy a Conditional Access rule that requires a compliant device.
That creates three issues:
In the tenants I review, the most common gap is a tenant with Conditional Access requiring compliant devices and no restriction on who can become compliant. The control exists on paper, but anyone can walk through it.
How Intune decides what is personal
Blocking personal devices only works if Intune can recognise corporate ones. The rules differ by platform:
One Windows detail catches people out. A device joined to Microsoft Entra during Windows setup, without Autopilot, is classed as corporate but is still blocked by a personal restriction, because that method does not give the admin per-device control. If you block personal Windows devices, you need either Autopilot registration or Windows corporate identifiers (manufacturer, model and serial number) uploaded in advance.
Create the restriction
Devices > Device onboarding > Enrollment > Device platform restriction.Before you turn it on for everyone, check
Devices > Enrollment failuresduring the pilot. Blocked enrollments show the reason Enrollment restriction not met, which tells you exactly who would have been affected.Keep productivity: the paths that stay open
Blocking personal enrollment is not the same as blocking personal devices from working. The goal is to stop personal devices becoming fully managed, while still letting people read email on their own phone in a controlled way.
The personal phone row is what keeps people happy. Pair the restriction with an Intune app protection policy and a Conditional Access rule that requires either a compliant device or an approved app with app protection. Staff can still use their own phone for email and Teams, but company data stays inside managed apps and can be selectively wiped.
Exceptions without a free-for-all
There will be exceptions: a director who insists on using a personal Mac, a contractor who needs a full desktop app, a test device for IT. Handle them with a second restriction that allows personal enrollment, assigned to a small, named security group, with a higher priority than the block. Microsoft recommends limiting personal Windows enrollment to only the users who need it, and that is the right instinct.
Document who is in that group and why, and review it every quarter. Exception groups have a habit of growing quietly until they include half the company.
If you use Windows 365 Link devices or other specialist hardware, Microsoft documents using an assignment filter on an allow restriction so those devices can enroll while unknown Windows devices are still blocked. The same pattern works for other edge cases where you can describe the device with a filter property.
Common mistakes
Frequently asked questions
Can I block personal devices without Windows Autopilot?
Yes. You can upload Windows corporate identifiers (manufacturer, model and serial number) so those devices are treated as corporate at enrollment. Autopilot is still the cleaner option for new hardware because the reseller can register devices before they ship.
Will blocking personal enrollment stop users reading email on their phone?
Not if you plan for it. Personal phones can use Outlook and Teams protected by an Intune app protection policy without enrolling. Conditional Access can require an approved app with app protection instead of a compliant device for mobile platforms.
What licence do Intune enrollment restrictions need?
Enrollment restrictions are part of Microsoft Intune Plan 1, which is included in Microsoft 365 Business Premium, E3 and E5. Conditional Access, which makes the restriction meaningful, needs Microsoft Entra ID P1, included in the same plans.
Microsoft’s article on enrollment restrictions lists every enrollment method and how it is classified. If you are planning a rollout, see our Intune deployment service and our approach to BYOD for Microsoft 365. For a broader look at your identity controls, our MFA enablement work pairs well with device restrictions.
Want to know whether personal devices are already sitting in your Intune tenant as “compliant”? Request a free Microsoft 365 security assessment and we will show you what is enrolled and how to tighten it without disrupting staff.