Skip to main content

136: Enrollment Restrictions

Implementation Effort: Medium — the settings are simple to configure, but good restriction design depends on your join, enrollment, and exception processes.

User Impact: Medium — well-designed restrictions prevent unsupported devices from onboarding, but poor communication can increase help desk volume.

Overview​

Enrollment restrictions in Microsoft Intune help define which platforms, ownership models, and device volumes are allowed into management. In a Zero Trust program, they are part of the front door: they reduce accidental or unauthorized enrollment paths and help make sure devices use the organization's intended onboarding methods, such as Windows Autopilot, Apple Automated Device Enrollment, or Android Enterprise.

Implementation Guidance​

  • Define which platforms and ownership scenarios your organization supports, and separate corporate-owned onboarding from personally owned or partner-managed cases.
  • Use device platform restrictions to block unsupported platforms and outdated operating system versions from enrolling in Intune in the first place.
  • Use device limit restrictions to prevent users from enrolling excessive numbers of devices, especially in shared-account or abuse scenarios.
  • Align restrictions with documented enrollment paths such as Autopilot, Apple Automated Device Enrollment, Android Enterprise, and company-owned dedicated device scenarios.
  • Create an exception process for legitimate edge cases such as lab devices or transitional migrations, rather than weakening the baseline for everyone.
  • Communicate restriction behavior clearly to support teams and end users so blocks are expected and actionable rather than confusing.

Reference​