Aller au contenu principal

104: Entra Shared Device Mode

Implementation Effort: Medium
User Impact: Medium

Overview​

Microsoft Entra shared device mode is designed for frontline or shared mobile devices where many users sign in and out during a shift. When configured correctly, supported Microsoft apps participate in a coordinated sign-in and sign-out experience, which reduces residual corporate data on the device and supports Zero Trust principles such as least privilege, session hygiene, and fast revocation when a worker ends a session.

Implementation Guidance​

  1. Define the shared-device scenario first: shift workers, checkout stations, clinical carts, warehouse scanners, or meeting-room style mobile devices. Do not use shared device mode as a substitute for dedicated kiosk design, Shared iPad, or standard single-user enrollment when those models are a better fit.
  2. Use supported enrollment and identity patterns in Microsoft Intune and Microsoft Entra ID. For Android, pair the device strategy with Android Enterprise enrollment and the supported Microsoft apps that understand shared device mode. For iOS/iPadOS, verify app and platform support carefully because shared sign-out behavior is app dependent.
  3. Limit the app set to what the worker actually needs. Shared devices should usually have a small number of Microsoft 365, line-of-business, and browser apps, plus strict app configuration, app protection, and Conditional Access requirements.
  4. Configure session controls and local data handling deliberately. Review sign-out behavior, token clearing, browser session persistence, cached files, and whether the app supports automatic cleanup when the user signs out.
  5. Combine the deployment with device compliance, device-based Conditional Access, and strong authentication. A shared device still needs a healthy device state, trustworthy network posture, and restricted admin access.
  6. Pilot with real frontline workflows. Validate sign-in time, handoff time between users, offline behavior, and what happens if a user walks away without signing out.

Reference​