089: Enrollment Restrictions

Implementation Effort: Low to Medium
User Impact: Medium

Overview

Enrollment restrictions in Microsoft Intune control which platforms, ownership types, and operating system versions are allowed to enroll, and how many devices a user can register. They are a preventative control that reduces unsupported or high-risk device onboarding before it becomes an operational problem. From a Zero Trust perspective, enrollment restrictions help enforce a known-good device estate. They should reflect your supported platform strategy rather than simply mirroring the vendor defaults.

Implementation Guidance

1. Set a default restriction baseline that blocks unsupported or legacy methods, especially new Android Device Administrator enrollment where it is no longer part of your standard.
2. Use version-based restrictions to prevent enrollment of devices that cannot meet your compliance or application baseline.
3. Set reasonable device limits per user to reduce uncontrolled device sprawl while allowing legitimate multi-device work patterns.
4. Create exception restrictions for tightly governed populations only, such as staging devices or specialist hardware that needs a temporary path.
5. Review enrollment failures and help desk tickets after rollout so you can adjust communications or scope without weakening the standard.
6. Keep restrictions aligned with documented platform support, Conditional Access design, and app prerequisites.

Reference

• Step 5 – Enroll devices in Microsoft Intune - Microsoft Intune — Includes guidance for creating device enrollment restrictions in Microsoft Intune.
• Android device enrollment guide for Microsoft Intune - Microsoft Intune — Guide to the Android enrollment methods supported by Microsoft Intune.