Security Policy Errors

How to Fix Microsoft Entra ID Device Enrollment Limit Exceptions

Kushani Nimanthika Oct 23, 2026 868 views

Question details

IT administrators need to bypass or increase the default device enrollment limits for user accounts during large-scale device deployments.

How to Manage Microsoft Entra ID Device Enrollment Limits

Product: Microsoft Entra ID and Intune
Device & OS: not provided
Scenario: Deploying devices at scale across an organization using Microsoft Intune and Entra ID.
Observed behavior: Standard user accounts receive a policy error or exception after reaching the standard limit of 15 enrolled devices, preventing further enrollments.

Before you start

Ensure you are signed in to the Microsoft Intune admin center with an account that has Global Administrator or Intune Service Administrator privileges.

Solution 1Recommended

Use a Device Enrollment Manager (DEM) Account

Assigning a Device Enrollment Manager account allows a single user to enroll and manage up to 1,000 devices, making it the ideal solution for large organizational rollouts.

A standard non-admin account is heavily restricted to prevent abuse, capping out at 15 devices. By elevating an account to a DEM, you bypass this restriction specifically for large-scale provisioning.

Note that a DEM account cannot be used with Apple Automated Device Enrollment (ADE) or Android Enterprise dedicated devices.

Access the Intune Admin Center

Navigate to Enrollment Managers

Go to Devices > Enroll devices, and then click on 'Device enrollment managers' under the General section.

Add a new DEM account

Click on 'Add', enter the User Principal Name (UPN) of the user account you want to assign as a DEM, and select 'Add' to save your changes.

Use a Device Enrollment Manager (DEM) Account

Deployment Tip: Using a DEM account significantly speeds up manual enrollment processes for shared devices or bulk deployments.

Solution 2

Adjust Standard User Device Restrictions

If standard users are hitting a custom limit lower than 15, you can modify the default enrollment restrictions to allow the maximum allowed standard limit.

Free Microsoft Office alternative

Deploy WPS Office on Your Managed Devices

Once your devices are successfully enrolled via Intune, equip them with WPS Office. It is a lightweight, highly compatible alternative to Microsoft Office that is exceptionally easy to package and deploy across your entire organizational infrastructure.

1. Download the Installer: Obtain the official WPS Office installer suitable for enterprise deployment.
2. Package for Intune: Wrap the installer as a Win32 app or standard MSI for seamless Intune distribution.
3. Assign to Devices: Deploy the packaged WPS Office app to your enrolled device groups via the Intune admin center.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installer minimizes bandwidth usage during Intune mass deployment.Cost-effective solution suitable for large-scale enterprise rollouts.Familiar user interface ensuring zero learning curve for end-users.

microsoft office alternative - wps office

Frequently Asked Questions

What is the absolute maximum number of devices a standard user can enroll in Entra ID?

By default, a standard non-admin account can enroll a maximum of 15 devices in Microsoft Entra ID and Intune. This limit cannot be exceeded for standard accounts without utilizing a DEM.

Can I increase the enrollment limit beyond 1,000 devices for a DEM account?

No, the hard limit for a single Device Enrollment Manager (DEM) account is 1,000 devices. If your deployment exceeds this, you will need to assign additional DEM accounts or use automated enrollment methods like Windows Autopilot.

Why am I getting a device limit exception if I haven't reached 15 devices?

Your organization's Intune administrator may have configured a custom device limit restriction that is lower than the default 15. Check your Azure AD device management policies to confirm the custom limits.

Microsoft Office Security Issues