Do you let your users Join AzureAD?

[Warwick_Tech]

When it comes to AzureAd and InTune, do you let your users join their own devices? or do you lock it down so only admins can do this?

 

I can see arguments for both, but feel we have no 'right' to enforce things like bitlocker on personal devices;

 

The problem comes from when Jimmy buys a laptop from argos and enters his AD credentials and there's no way to remove them without some powershell work which you may not even have access to if we disable his account...

 

Lots of people muttering about bricked devices!

[free780]

This isn't to do with the new Cyber Essentials requirements is it?

 

Removing the ability to AAD register doesn't stop authentication in the browser.

 

You can inflict MDM on personal devices or MAMWE.

 

In an ideal world every user would have an organisational owned device but it's not ideal.

[Warwick_Tech]

This isn't to do with the new Cyber Essentials requirements is it?

 

Removing the ability to AAD register doesn't stop authentication in the browser.

 

You can inflict MDM on personal devices or MAMWE.

 

In an ideal world every user would have an organisational owned device but it's not ideal.

 

No, not sure what the new requirements are - I'm just talking general device management, as Ms are doing everything in their power to 'merge' home and work devices, despite not understanding the end user may not understand or want their device having policies forced to it.

 

The argument of course is 'admin knows best' but realistically I don't see how you can make an entire device 'compliant' - the idea of cloud access via portals etc. is great, conditional access works perfectly for this; it's just the concept of the windows account itself being linked to Azure...

[5tu]

In MEM > Enrollment Restrictions we block "personally owned" devices.....