Prevent personal Windows 10 devices from enrolling to Microsoft Intune

Sometimes you see a lot of personally owned devices show up in your Intune dashboard. If you want to prevent this from happening you can use Device enrollment restrictions in Intune to block personal devices. In this post I will show you how to prevent personally owned Windows 10 devices from enrolling in Microsoft Intune.

When blocking personally owned devices, we have below options to enroll in Intune:

• The enrolling user is using a device enrollment manager account.
• The device enrolls through Windows AutoPilot.
• The device is registered with Windows Autopilot but is not an MDM enrollment only option from Windows Settings.
• The device’s IMEI number is listed in Device enrollment > Corporate device identifiers. (Not supported for Windows Phone 8.1.)
• The device enrolls through a bulk provisioning package.
• The device enrolls through GPO, or automatic enrollment from SCCM for co-management.

Setup enrollment restriction

In Intune we have the option to set device enrollment restrictions for Android (work profile), iOS, macOS and Windows. But we focus in this post on Windows.

1. Open the Device Management portal and click Device enrollment – Enrollment Restrictions
2. Click Create restriction

1. Give the enrollment restriction policy a Name
2. Select Device Type Restriction in the dropdown list
3. Click Select Platforms
4. Switch on all required platforms

1. Click Configure platforms
2. Set Windows (MDM) to Block to prevent personal Windows devices to enroll in MDM
3. Click OK and Create

Now we need to assign the policy to a security group. In my example I assign it to a group with all my Intune licensed users.

End-user experience

Now let`s have a look at the end-user experience. We have blocked the option to enroll personally owned Windows 10 devices.
When the users tries to manually enroll the device in MDM from Settings is looks like this.

With the error: There was a problem.
Your organization does not support this version of Windows (0x80180014)

When the user tries to manually join Azure AD with automatic MDM enrollment from Settings.

We see this error: Something went wrong.
This feature is not supported. Contact your system administrator with the error code 80180014.

When we try to enroll the devices during the Out-of-the-box-experience as part of an Azure AD join, this is how it looks.

We are presented below error:
Something went wrong.
This feature is not supported. Contact your system administrator with the error code 80180014.

We have blocked the enrollment of personally owned devices. Keep in mind when you set this up, you have blocked the option to access corporate data when using Windows Information Protection like I described in my previous blog.