Skip to content

Commit e894570

Browse files
v-stsavellv-stsavell
authored
Merge pull request #8208 from lenewsad/EnrollmentRestrctionsGuide
TOC updates for enrollment restrictions
2 parents 1f2dfb9 + 8191f8f commit e894570

10 files changed

Lines changed: 471 additions & 209 deletions

‎memdocs/intune/enrollment/android-move-device-admin-work-profile.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ When users see that they're out of compliance for this reason, they can tap **Re
4545
- [Set Android Enterprise personally-owned work profile enrollment](android-work-profile-enroll.md) for the group of users who are moving to personally-owned work profile.
4646
- Consider increasing your user device limits. When unenrolling devices from device administrator management, device records might not be immediately removed. To provide cushion during this period, you might need to increase device limit capacity. This increase is so that the users can enroll into personally-owned work profile management.
4747
- [Configure Azure Active Directory device settings](/azure/active-directory/devices/device-management-azure-portal#configure-device-settings) for Maximum number of devices per user.
48-
- Adjust the [Intune device limit restrictions](enrollment-restrictions-set.md#create-a-device-limit-restriction) by setting the Device limit.
48+
- Adjust the [Intune device limit restrictions](create-device-limit-restrictions.md) by setting the device limit.
4949

5050
## Create device compliance policy
5151

‎memdocs/intune/enrollment/create-device-limit-restrictions.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
# required metadata
3+
4+
title: Create device limit restrictions
5+
titleSuffix: Microsoft Intune
6+
description: Restrict the number of devices allowed to enroll in Microsoft Intune.
7+
keywords:
8+
author: Lenewsad
9+
ms.author: lanewsad
10+
manager: dougeby
11+
ms.date: 08/08/2022
12+
ms.topic: how-to
13+
ms.service: microsoft-intune
14+
ms.subservice: enrollment
15+
ms.localizationpriority:
16+
ms.technology:
17+
ms.assetid:
18+
19+
# optional metadata
20+
21+
#ROBOTS:
22+
#audience:
23+
24+
ms.reviewer: maholdaa
25+
ms.suite: ems
26+
search.appverid: MET150
27+
#ms.tgt_pltfrm:
28+
ms.custom: intune-azure
29+
ms.collection:
30+
- M365-identity-device-management
31+
- highpri
32+
---
33+
34+
# Create device limit restrictions in Intune
35+
36+
**Applies to**
37+
* Android
38+
* iOS
39+
* macOS
40+
* Windows 10
41+
* Windows 11
42+
43+
44+
[!INCLUDE [azure_portal](../includes/azure_portal.md)]
45+
46+
Create a device limit enrollment restriction policy to limit the number of devices a user can enroll in Microsoft Intune. Device limit restrictions work on devices that meet the following criteria:
47+
48+
* Microsoft Intune-managed
49+
* Established contact with Intune within last 90 days
50+
* Not in a registration-pending state for more than 24 hours
51+
* Hasn't failed Apple enrollment
52+
* Hasn't been deleted from Microsoft Intune
53+
* Enrollment type is not in shared mode (check DeviceCountsForDeviceCap for detail)
54+
55+
You can create a new device limit-enrollment restriction policy in the Microsoft Endpoint Manager admin center or use the default policy that's already available. You can have up to 25 device limit restriction policies.
56+
57+
This article describes how to create and configure a device limit-enrollment restriction policy in the admin center.
58+
59+
## Default policy
60+
Microsoft Intune provides one default policy for device limit restrictions that you can edit and customize as needed. Intune applies the default policy to all user and userless enrollments until you assign a higher-priority policy.
61+
62+
## Create a device limit restriction
63+
64+
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
65+
2. Go to **Devices** > **Enrollment restrictions** > **Create restriction** > **Device limit restriction**.
66+
3. On the **Basics** page, give the restriction a **Name** and optional **Description**.
67+
4. Choose **Next** to go to the **Device limit** page.
68+
5. For **Device limit**, select the maximum number of devices that a user can enroll.
69+
![Screenshot that shows how to choose a device limit.](./media/enrollment-restrictions-set/choose-device-limit.png)
70+
6. Choose **Next** to go to the **Scope tags** page.
71+
7. On the **Scope tags** page, optionally add the scope tags you want to apply to this restriction. For more information about scope tags, see [Use role-based access control and scope tags for distributed IT](../fundamentals/scope-tags.md).
72+
8. Choose **Next** to go to the **Assignments** page.
73+
9. Choose **Select groups to include** and then use the search box to find groups that you want to include in this restriction. The restriction applies only to groups to which it's assigned. If you don't assign a restriction to at least one group, it won't have any effect. Then choose **Select**.
74+
![Screenshot that shows selecting groups.](./media/enrollment-restrictions-set/select-groups-device-limit.png)
75+
10. Select **Next** to go to the **Review + create** page.
76+
11. Select **Create** to create the restriction. The new restriction appears in your list of restrictions and is given a higher priority than the default policy. For information about changing the priority level, see [Change restriction priority](create-device-limit-restrictions.md#change-restriction-priority) (in this article).
77+
78+
## Edit enrollment restrictions
79+
80+
Edits are applied to new enrollments and don't affect devices that are already enrolled.
81+
82+
1. Go to **Enrollment device limit restrictions** to bring up the list of your policies.
83+
2. Select the name of the policy you want to change.
84+
3. Select **Properties**.
85+
4. Select **Edit**.
86+
5. Make your changes and select **Review + save**.
87+
6. Review your changes and select **Save**.
88+
89+
## Change restriction priority
90+
91+
When a group is assigned multiple restrictions, the priority level determines which policy gets applied. The restriction with highest priority (*1* being the highest priority position) is applied and the other restrictions are disregarded. For example:
92+
93+
1. Joe belongs to two user groups in Intune: Group A and Group B.
94+
2. Group A is assigned a restriction policy. Its priority level is 5.
95+
3. Group B is assigned a restriction policy. The priority level is 2.
96+
4. Joe is subject only to the priority 2 restrictions.
97+
98+
When you create a restriction, it's added to the list just above the default. You can change the priority of non-default restrictions.
99+
100+
1. Go to **Enrollment device limit restrictions**.
101+
2. Select **Device limit restrictions** to bring up the list of your policies.
102+
3. Hover over the policy in the **Priority** column,and then select and drag the priority to the desired position in the list.
103+
104+
## Device user experience
105+
BYOD users who reach their device limit receive a message during enrollment explaining the restriction. To continue enrolling, the device user must unenroll an existing device. Alternatively, as the admin you can increase the device limit in the admin center. For more information about troubleshooting enrollment errors such as this one, see [Troubleshoot device enrollment](/troubleshoot/mem/intune/troubleshoot-device-enrollment-in-intune#device-cap-reached).
106+
107+
![Example image of device limit notification which reads, "Couldn't add your device. You have added the maximum number of devices allowed by your IT support. You must remove a device before you can add a new one.](./media/enrollment-restrictions-set/enrollment-restrictions-ios-set-limit-notification.png)
108+
109+
110+
111+
112+

‎memdocs/intune/enrollment/create-device-platform-restrictions.md‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
---
2+
# required metadata
3+
4+
title: Create device platform restrictions
5+
titleSuffix: Microsoft Intune
6+
description: Restrict personally owned devices, and specific device platforms and OS versions from enrolling in Intune.
7+
keywords:
8+
author: Lenewsad
9+
ms.author: lanewsad
10+
manager: dougeby
11+
ms.date: 08/08/2022
12+
ms.topic: how-to
13+
ms.service: microsoft-intune
14+
ms.subservice: enrollment
15+
ms.localizationpriority:
16+
ms.technology:
17+
ms.assetid:
18+
19+
# optional metadata
20+
21+
#ROBOTS:
22+
#audience:
23+
24+
ms.reviewer: maholdaa
25+
ms.suite: ems
26+
search.appverid: MET150
27+
#ms.tgt_pltfrm:
28+
ms.custom: intune-azure
29+
ms.collection:
30+
- M365-identity-device-management
31+
- highpri
32+
---
33+
34+
# Create device platform restrictions
35+
36+
**Applies to**
37+
* Android
38+
* iOS
39+
* macOS
40+
* Windows 10
41+
* Windows 11
42+
43+
44+
[!INCLUDE [azure_portal](../includes/azure_portal.md)]
45+
46+
Create a device platform enrollment restriction policy to restrict devices from enrolling in Intune. Available restrictions include:
47+
48+
* Device platform
49+
* OS version
50+
* Manufacturer
51+
* Ownership (personally-owned)
52+
53+
You can create a new device platform restriction policy in the Microsoft Endpoint Manager admin center or use the default policy that's already available. You can have up to 25 device platform restriction policies.
54+
55+
This article describes the device platform restrictions supported in Microsoft Intune and how to configure them in the admin center.
56+
57+
## Default policy
58+
Microsoft Intune provides one default policy for device platform restrictions that you can edit and customize as needed. Intune applies the default policy to all user and userless enrollments until you assign a higher-priority policy.
59+
60+
## Best practice - Android platform restrictions
61+
Since Intune supports two Android platforms, it's important to understand how OS version restrictions work when used together with device platform restrictions:
62+
* If you allow both platforms for the same group, and then refine it for specific and non-overlapping versions, devices are sent through the Android enrollment flow that's picked for their version.
63+
* If you allow both platforms, but block the same versions, devices running blocked versions can't enroll. Users on these devices are sent through the Android device administrator enrollment flow before they're blocked and prompted to sign out.
64+
65+
## Create a device platform restriction
66+
67+
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
68+
2. Go to **Devices** > **Enroll devices** > **Enrollment device platform restrictions**.
69+
3. Select the tab along the top of the page that corresponds with the platform you're configuring. Your options:
70+
71+
* **Android restrictions**
72+
* **Windows restrictions**
73+
* **MacOS restrictions**
74+
* **iOS restrictions**
75+
76+
4. Select **Create restriction**.
77+
5. On the **Basics** page, give the restriction a name and optional description.
78+
6. Select **Next**.
79+
7. On the **Platform settings** page, configure the restrictions for your selected platform. Your options:
80+
- **Platform** (Android): Select **Allow** to permit a platform to enroll, and **Block** to restrict it.
81+
- **MDM** (Windows, macOS, and iOS/iPadOS): Select **Allow** to permit a platform to enroll, and **Block** to restrict it.
82+
- **Personally-owned**: Select **Allow** to permit devices to enroll and operate as personal devices.
83+
- **Device manufacturer** (Android): Enter a comma-separated list of the manufacturers that you want to block.
84+
- **Allow min/max range** (Android, Windows, iOS/iPadOS): Enter the minimum and maximum OS versions allowed to enroll. Supported version formats include:
85+
- Windows supports major.minor.build.rev for Windows 10 and Windows 11 only.
86+
- Android device administrator and Android Enterprise work profile support major.minor.rev.build.
87+
- iOS/iPadOS supports major.minor.rev.
88+
89+
> [!TIP]
90+
> The min/max range isn't applicable to Apple devices that enroll with the Device Enrollment Program, Apple School Manager, or the Apple Configurator app. Although Intune doesn't block ADE enrollments that use Company Portal to authenticate, not meeting OS requirements impacts registration because devices can't create the Azure AD device record used to evaluate Conditional Access policies. You can tell that this is the case if a device user receives an error message that says "Couldn't map device record with a user" after they sign in to Company Portal.
91+
92+
8. Select **Next**.
93+
9. Optionally, add scope tags to the restriction. For more information about scope tags, see [Use role-based access control and scope tags for distributed IT](../fundamentals/scope-tags.md).
94+
95+
> [!NOTE]
96+
> If you apply scope tags to a restriction, only Intune users within scope can view and manage the policy. Only people in scope can view and reorder a restriction, or change its priority level. They can also see the relative priority of the restriction, even if they can't see all restrictions.
97+
98+
10. Select **Next**.
99+
11. On the **Assignments** page, select **Add groups** and then use the search box to find and select groups. To assign the restriction to all device users, select **Add all users**. If you don't assign a restriction to at least one group, the restriction won't take effect.
100+
12. Optionally, after you assign groups, select **Edit filter** to restrict the policy assignment further with filters. Filters are available for macOS, iOS, and Windows policies. For more information, see [Apply assignment filters](create-device-platform-restrictions.md#apply-assignment-filters) (in this article).
101+
13. Select **Next**.
102+
14. Review your policy, and then select **Create** to create it.
103+
104+
You can view the new restriction policy and access its properties in the **Enrollment device platform restrictions** > **Device type restrictions** table. Select and drag the restriction to reposition it in the table and change its priority.
105+
106+
## Apply assignment filters
107+
108+
You can use assignment filters to include and exclude additional devices from certain group-targeted policies. Enrollment restrictions and ESP policies both support the use of assignment filters.
109+
110+
For example, you can use a filter to allow personal Windows devices to enroll while blocking devices that run a specific operating system SKU. To achieve this outcome, apply a preconfigured filter to your enrollment restriction assignments. The filter needs to have the `operatingSystemSKU` property in its rules. Example steps:
111+
112+
1. Create a platform enrollment restriction policy for Windows.
113+
2. In the platform settings, select the option that allows personal devices to enroll.
114+
3. In the assignments settings, select the groups you want to assign.
115+
4. Select **Edit filter** and then apply your preconfigured filter that contains the `operatingSystemSKU` property. The applied property blocks devices running Windows 10 Home edition.
116+
117+
For more information about creating filters, see [Create a filter](../fundamentals/filters.md).
118+
119+
### Supported filter properties
120+
121+
Enrollment restrictions support fewer filter properties than other group-targeted policies. This is because devices aren't yet enrolled, so Intune doesn't have the device info to support all properties. You'll see the limited selection of properties when you:
122+
123+
* Configure a device platform restriction policy for Apple and Windows devices.
124+
* Configure an enrollment status page (ESP) policy for Windows.
125+
* Edit a filter that's in-use in an enrollment restriction or ESP profile.
126+
127+
The following filter properties are always available to use with enrollment policies:
128+
129+
**Windows**
130+
131+
* OS version
132+
* Operating System SKU
133+
* Enrollment profile name
134+
135+
**iOS/iPadOS and macOS**
136+
* Manufacturer
137+
* Model
138+
* OS version
139+
* Ownership
140+
* Enrollment profile name
141+
142+
For more information about these properties, see [device properties](../fundamentals/filters-device-properties.md#device-properties). Filters can't be used with Android enrollment restrictions.
143+
144+
## Edit enrollment restrictions
145+
146+
Edits are applied to new enrollments and do not affect devices that are already enrolled.
147+
148+
1. Go to **Enrollment device platform restrictions**.
149+
2. In the **Device type restrictions** table, select the name of the policy you want to change.
150+
3. Select **Properties**.
151+
4. Select **Edit**.
152+
5. Make your changes and select **Review + save**.
153+
6. Review your changes and select **Save**.
154+
155+
156+
157+
158+
159+
160+
161+
162+
163+
164+
165+
166+
167+
168+
169+
170+
171+
172+
173+
174+
175+
176+
177+
178+
179+
180+
181+
182+
183+
184+

‎memdocs/intune/enrollment/device-enrollment.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,4 +186,4 @@ The MDM certificate renews automatically as long as enrolled devices are communi
186186

187187
## Next steps
188188

189-
You can adjust the settings in Intune to restrict specific platforms from enrolling. For more information, see [Create a device platform restriction](enrollment-restrictions-set.md#create-a-device-platform-restriction).
189+
You can adjust the settings in Intune to restrict specific platforms from enrolling. For more information, see [Create a device platform restriction](create-device-platform-restrictions.md).

‎memdocs/intune/enrollment/device-limit-intune-azure.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
# required metadata
33

4-
title: Understand between Intune and Azure device limit restrictions
5-
titleSuffix:
6-
description: Understand the differences between Intune's device limit restrictions and Azure AD's delimit restrictions.
4+
title: Understand Intune and Azure AD device limit restrictions
5+
titleSuffix: Microsoft Intune
6+
description: Learn the differences between Intune device limit restrictions and Azure AD's delimit restrictions.
77
keywords:
88
author: Lenewsad
99
ms.author: lanewsad
@@ -31,7 +31,7 @@ ms.collection:
3131
- highpri
3232
---
3333

34-
# Understand Intune and Azure AD's device limit restrictions
34+
# Understand Intune and Azure AD device limit restrictions
3535

3636
**Applies to**
3737
- Android
@@ -48,7 +48,7 @@ This article clarifies when these limits are applied based on your configuration
4848

4949
## Intune device limit restrictions
5050

51-
Intune device limit restrictions set the maximum number of devices that a user can control (maximum setting is 15). To set this **Device limit**, go to [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Enrollment restrictions**. For more information, see [Create a device limit restriction](enrollment-restrictions-set.md#create-a-device-limit-restriction)
51+
Intune device limit restrictions set the maximum number of devices that a user can control (maximum setting is 15). To set this **Device limit**, go to [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Enrollment restrictions**. For more information, see [Create a device limit restriction](create-device-limit-restrictions.md).
5252

5353
## Azure device limit restriction
5454

@@ -128,5 +128,4 @@ For the device limit restriction in Azure, the **Maximum number of devices per u
128128
## Next steps
129129

130130
- [Create a device limit restriction in Azure.](/azure/active-directory/devices/device-management-azure-portal#configure-device-settings)
131-
- [Configure device settings in Azure.](enrollment-restrictions-set.md#create-a-device-limit-restriction)
132131
- [Learn more about registration and domain joined.](/azure/active-directory/devices/overview#getting-devices-in-azure-ad)

0 commit comments

Comments
 (0)