Conditional Access Problems

How to Restrict Azure AD Device Enrollment to Specific Administrators

Adam Davis Oct 7, 2026 870 views

Question details

The organization needs to restrict Azure AD Join and Intune device enrollment so that only specific administrator accounts can enroll devices before handing them over to users.

How to Restrict Azure AD Device Enrollment to Specific Administrators

Product: Microsoft Intune / Microsoft Entra ID
Device & OS: not provided
Scenario: Setting up enterprise devices where IT administrators perform the initial Azure AD Join and Intune enrollment, followed by assigning the device to the end user.
Observed behavior: Default settings may allow any user to enroll devices. The goal is to restrict this capability exclusively to approved IT administrators and appropriately reassign the primary user post-enrollment.

Before you start

Ensure you have Global Administrator or Intune Administrator privileges in your Microsoft Entra ID tenant before attempting to modify device enrollment restrictions.

Solution 1Recommended

Configure Device Enrollment Restrictions in Microsoft Intune and Entra ID

Use Microsoft Entra device settings and Intune enrollment restrictions to limit enrollment capabilities to designated administrator groups.

To ensure that only authorized administrators can enroll devices, you must configure device join restrictions in Microsoft Entra ID, apply enrollment restrictions in Intune, and manually reassign the primary user after the setup is complete.

Restrict Microsoft Entra Join

Log in to the Microsoft Entra admin center. Navigate to Identity > Devices > Device settings. Under 'Users may join devices to Microsoft Entra', select 'Selected' and choose the specific administrator group allowed to join devices.

Configure Intune Enrollment Restrictions

Go to the Microsoft Intune admin center. Navigate to Devices > Enroll devices > Enrollment restrictions. Select 'Create restriction' to block personal device enrollment or limit OS platforms, ensuring only admin-provisioned corporate devices are allowed.

Change the Primary User Post-Enrollment

After the administrator enrolls the device, navigate to Devices > All devices in the Intune admin center. Select the newly enrolled device, click on 'Properties', and change the 'Primary User' from the administrator to the actual end user so they receive the correct policies and app assignments.

Configure Device Enrollment Restrictions in Microsoft Intune and Entra ID

Device Enrollment Managers (DEM): If administrators need to enroll a large number of devices (more than the standard limit of 15 per user), consider adding their accounts to the Device Enrollment Managers (DEM) list in Intune.

Solution 2

Use Conditional Access to Block Unauthorized Enrollment

Implement a Conditional Access policy to strictly block the Intune enrollment app for non-administrators.

Free Microsoft Office alternative

Deploy WPS Office to Your Newly Enrolled Enterprise Devices

While configuring device management and access policies in Microsoft Intune, consider deploying a lightweight and cost-effective productivity suite to your enterprise devices. WPS Office is a highly compatible, free alternative to Microsoft Office that meets everyday business needs without heavy licensing costs.

1. Download the Installer: Obtain the official enterprise or standard installer from the WPS Office website.
2. Package for Intune: Wrap the installer using the Microsoft Win32 Content Prep Tool for deployment via Microsoft Intune.
3. Deploy to Devices: Assign the packaged application to your enrolled devices or user groups as a required or available app.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight deployment profile, ideal for pushing to newly Intune-enrolled enterprise devices.All-in-one suite combining document, spreadsheet, presentation, and PDF tools in a single familiar interface.Cost-effective solution to equip non-power users with essential productivity tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why is the enrolled device showing the administrator as the primary user?

When an administrator enrolls a device using their own Azure AD credentials, Intune automatically assigns them as the Primary User. You must manually change the Primary User in the Intune device properties to the actual end user so they can access their specific apps, licenses, and Conditional Access policies.

Can I use Conditional Access to restrict device enrollment?

Yes. You can create a Conditional Access policy in Microsoft Entra ID targeting the 'Microsoft Intune Enrollment' cloud app. Set the policy to require Multi-Factor Authentication or block access entirely for users outside of your approved administrator groups.

Where do I find enrollment restrictions in the new admin portal?

Enrollment restrictions have moved from the legacy Azure portal to the Microsoft Intune admin center. Navigate to Devices > Enroll devices > Enrollment restrictions to configure policies regarding device limits and allowed platforms.

What is a Device Enrollment Manager (DEM) account?

A DEM account is a special Intune permission applied to an Azure AD user account that allows it to enroll up to 1,000 devices. It is highly recommended for IT administrators who bulk-enroll devices before distributing them to end users.

Microsoft Office Security Issues