Conditional Access Problems

How to Limit Microsoft 365 Sign-In Devices with Intune and Conditional Access

Algirdas Jasaitis Sep 30, 2026 868 views

Question details

The user wants to restrict the number of devices that can enroll or sign in to Microsoft 365, seeking to lower the standard limits to only one or two devices.

How to Limit Microsoft 365 Sign-In Devices with Intune and Conditional Access

Product: Microsoft Intune
Device & OS: not provided
Scenario: Configuring device enrollment and sign-in limits for a Microsoft 365 organizational environment to enhance security.
Observed behavior: Administrators need to differentiate and configure app activation limits, Intune enrollment limits, and Microsoft Entra sign-in controls to restrict access to a specific number of approved devices.

Before you start

Ensure you have Intune Administrator or Global Administrator privileges in your Microsoft Entra ID tenant to modify enrollment restrictions and conditional access policies.

Solution 1Recommended

Configure Device Limit Restrictions in Microsoft Intune

Reduce the maximum number of devices a single user can enroll in Microsoft Intune from the default limit.

By default, Intune allows up to 15 devices per user. Lowering this limit ensures that users cannot enroll unnecessary personal devices into your corporate network.

Access the Intune Admin Center

Navigate to Device Enrollment

In the left-hand navigation pane, select 'Devices', then click on 'Enrollment'.

Open Device Limit Restrictions

Under the Enrollment policies, locate and click on 'Device limit restrictions'.

Modify the Enrollment Limit

Click on the default policy to edit it (or create a new one). Change the maximum number of enrolled devices to your preferred threshold (e.g., 5 or lower) and save the configuration.

Configure Device Limit Restrictions in Microsoft Intune

Scope of the limit: This setting strictly limits Intune device enrollment. It does not limit web-based sign-ins to Microsoft 365 apps on unmanaged devices.

Solution 2

Apply Microsoft Entra Conditional Access Policies

Use Conditional Access to ensure that only compliant or enrolled devices can sign in to Microsoft 365 services.

Free Microsoft Office alternative

Manage Your Work Efficiently with WPS Office

While Microsoft 365 provides extensive administrative controls through Intune, setting it up can be complex. If you need a lightweight, cost-effective, and highly compatible alternative for everyday document editing, try WPS Office. It provides powerful word processing, spreadsheets, and presentations without the overhead of complex enterprise enrollment limits.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Application: Run the downloaded installer and follow the on-screen instructions to complete the setup.
3. Start Creating: Open WPS Office and start editing your documents, spreadsheets, and presentations instantly.

Fully compatible with Microsoft Office formats (Docx, Xlsx, Pptx).Lightweight application that requires no complex IT enrollment policies.Free to use with a familiar, user-friendly interface.Seamless cross-platform support for Windows, Mac, Linux, iOS, and Android.

microsoft office alternative - wps office

Frequently Asked Questions

Are Microsoft 365 app activation limits the same as Intune enrollment limits?

No. Microsoft 365 app activation limits dictate how many devices can actively install and license the Office desktop apps (usually 5 PCs/Macs, 5 tablets, and 5 phones). Intune enrollment limits restrict how many devices a single user can manage within your organization's Intune MDM system.

Can I limit Microsoft 365 sign-in to exactly one device per user?

Limiting sign-ins to exactly one device natively is challenging. You can limit Intune enrollment to one device, but to strictly prevent browser sign-ins from other devices, you must deploy strict Conditional Access policies requiring a compliant device.

What happens if a user exceeds the Intune device enrollment limit?

During the setup process, the user will receive an error message stating they have reached the maximum number of allowed devices. They will need to unenroll or delete an older, unused device from the Company Portal before they can enroll the new one.

Do Conditional Access policies affect existing signed-in users?

Yes. Once a Conditional Access policy is enforced (such as requiring a compliant device), users on non-compliant devices will be prompted to re-authenticate or will lose access upon their next session token refresh.

Microsoft Office Security Issues