Skip to main content

074: Entra Shared Device Mode

Implementation Effort: Medium to High

User Impact: Medium

Overview​

Microsoft Entra shared device mode is designed for supported mobile applications on devices that are handed from one worker to another, especially in frontline scenarios. It enables a coordinated sign-in and sign-out experience across participating apps so local work data can be reduced when shifts change.

This is valuable in Zero Trust because trust should follow the active user session, not linger from the previous user on a shared device.

Implementation Guidance​

  1. Confirm that the business scenario is truly a shared-user scenario rather than a dedicated kiosk or a standard assigned corporate device.
  2. Verify that the apps users need actually support shared device mode. The feature depends on participating apps and identity integration, not only on Intune policy.
  3. Choose the enrollment path that supports your device type and management goals, such as an appropriate corporate-owned mobile enrollment model for the platform.
  4. Design the sign-in/out workflow carefully: inactivity timeout, handoff between shifts, what happens offline, and how leftover session data is removed.
  5. Deploy required apps, configuration, and Conditional Access policies that match the shared-device scenario.
  6. Document clearly that shared device mode is different from Shared iPad. Shared device mode focuses on app session behavior; Shared iPad creates multiple user partitions on supported iPads.

Reference​