Update enrollment-restrictions-set.md

Changed from plural "devices" to singular "device" to simplify reading

Author: lenewsad

memdocs/intune/enrollment/enrollment-restrictions-set.md

@@ -111,7 +111,7 @@ The following enrollment methods are authorized for corporate enrollment:
 - The device enrolls through GPO, or [automatic enrollment from Configuration Manager for co-management](/configmgr/comanage/quickstart-paths#bkmk_path1).
 
 > [!NOTE]
-> Since co-managed devices are enrolled in the Microsoft Intune service based on its Azure AD device token, and not a user token, only the default Intune enrollment restriction will apply to the enrollment. 
+> Since a co-managed device enrolls in the Microsoft Intune service based on its Azure AD device token, and not a user token, only the default Intune enrollment restriction will apply to it. 
  
 Intune marks devices going through the following types of enrollments as corporate-owned. But Intune blocks devices enrolling  since they don't offer the Intune administrator per-device control, they are blocked:  
 - [Automatic MDM enrollment](windows-enroll.md#enable-windows-automatic-enrollment) with [Azure Active Directory join during Windows setup](/azure/active-directory/device-management-azuread-joined-devices-frx)\*.