Intune: Block Personal Device Enrollment

Key insights

• Enrollment method: Intune classifies a device as corporate or personal based on how the device was enrolled, not because it "detects" ownership automatically.
  Control the enrollment path to influence ownership status.
• Device platform restrictions: Use the Device platform restriction policy (Devices > Device onboarding > Enrollment > Device platform restriction) and set Personally owned to Block for platforms you want to stop from enrolling.
  You can also block by platform, OS version, manufacturer (Android), or set a device limit per user.
• Windows MDM enrollment control: Enable the new setting Disable MDM enrollment when adding work or school account on Windows to close the sign-in path that can enroll personal Windows devices.
  This setting targets the automatic enrollment triggered when users add a work or school account on Windows.
• Conditional Access vs Enrollment restrictions: Conditional Access controls access to resources but does not reliably stop device enrollment.
  Use both Conditional Access and enrollment restrictions together to cover sign-in flows and enrollment attempts.
• Already enrolled devices: Blocking new enrollments does not remove devices that are already enrolled as personally owned.
  Admins must retire or remove those devices from Intune if they need them gone.
• Testing and best practice: Test changes in a lab or pilot tenant before wide rollout and monitor inventory after implementing restrictions.
  Apply consistent policies across tenants if you manage multiple environments and review Autopilot/Entra ID flows for special cases.

Keywords

block personal devices Intune, prevent BYOD enrollment Intune, disable personal device enrollment Microsoft Intune, restrict personal device enrollment Intune, Intune enrollment restrictions personal devices, allow corporate devices only Intune, block personal phones tablets Intune, configure Intune device enrollment restrictions