061: Enrollment Restrictions

Implementation Effort: Low to Medium

User Impact: Medium

Overview

Enrollment restrictions in Microsoft Intune help organizations control which devices can enroll and under what conditions. They are useful for preventing unsupported platforms, blocking unmanaged personal ownership where policy requires corporate ownership, and limiting how many devices a user can enroll.

In a Zero Trust design, enrollment restrictions are a preventive control: they reduce the chance that the wrong device type enters the management boundary in the first place.

Implementation Guidance

1. Review your provisioning strategy before creating restrictions. Restrictions should reinforce your approved enrollment paths, not contradict them.
2. Use device platform restrictions to block unsupported platforms, older OS versions, or personal ownership where that is required by policy.
3. Use device limit restrictions to control how many devices a user can enroll, especially in high-risk or tightly managed environments.
4. Create dedicated restriction profiles for exception groups instead of weakening the global default for everyone.
5. Pay attention to policy priority. Intune evaluates higher-priority assigned restriction policies before the default policy.
6. Test both successful and blocked enrollment paths so help desk teams understand the user experience and error messages.
7. Review restrictions after mergers, new platform introductions, or shifts between BYOD and corporate-owned programs.

Reference

• Set enrollment restrictions in Microsoft Intune
• Step 5 – Enroll devices in Microsoft Intune - Microsoft Intune — Covers device enrollment setup and restrictions in Microsoft Intune.
• Planning guide to move to Microsoft Intune - Microsoft Intune — Provides planning guidance for rolling out device enrollment in Microsoft Intune.