Prevent BYOD and Other Devices Registering in Azure AD

[Scorpio]

Hi all

 

I've be trying this for ages but cannot for the life of me prevent this from happening.

 

I can prevent Enrolment into Azure AD and I can prevent Enrolment into Intune, but still cannot stop the registration of devices by the users.

 

I've tried conditional access with multiple different Filter for devices:

 

IsCompliant

TrustType

Deviceownership

 

Still the user can Register a device.

 

Obviously with Intune the Button "Users may register their devices with Azure AD" is greyed out in AAD Device settings page.

 

How have you guys done this ?

 

Thanks

 

S

Edited November 12, 2022 by Scorpio

[Roberto]

I suspect you have confused AAD join and AAD registered. See https://www.how2code.info/en/blog/azure-ad-registered-vs-joined-devices/

 

There’s nothing wrong with Devices being registered as part of MDM onboarding.

[Scorpio]

Hi

 

I'm aware of the differences between AAD Join and Register

 

We don't want people registering devices that are not corporate devices ? We just want to AADJoin Devices by an authorised DEM role user, without random machines popping up in AAD as registered.

 

Explain why you think this isn't an issue ? I'm intrigued if we don't want these devices Managed or not on the system. Happy to hear your reasoning.

 

Cheers

 

S

[free780]

Hi

 

I'm aware of the differences between AAD Join and Register

 

We don't want people registering devices that are not corporate devices ? We just want to AADJoin Devices by an authorised DEM role user, without random machines popping up in AAD as registered.

 

Explain why you think this isn't an issue ? I'm intrigued if we don't want these devices Managed or not on the system. Happy to hear your reasoning.

 

Cheers

 

S

 

Here.

 

https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal#configure-device-settings

 

Be aware if you want users to use passwordless auth on personal devices this may be hindered.

[Scorpio]

Hi Free780

 

What exactly am I looking at in the link? That shows it greyed out too, but doesn't explain how to stop persal devices from being registered?

 

Thanks

 

S

[psydii]

I have been told that if you have intune you can't stop AAD Registration (as you see the option is greyed out on the panel you are looking at).

 

You can however stop BYOD enrolment into Intune/MEM:

 

 

I haven't not managed to navigate this successfully myself, and we are just extremely careful with policies, only deploying to groups that are comprised entirely of corporate owned devices.

Edited November 13, 2022 by psydii

[Scorpio]

I have been told that if you have intune you can't stop AAD Registration (as you see the option is greyed out on the panel you are looking at).

 

You can however stop BYOD enrolment into Intune/MEM:

 

 

I haven't not managed to navigate this successfully myself, and we are just extremely careful with policies, only deploying to groups that are comprised entirely of corporate owned devices.

 

Thanks for the input

 

But this wont stop someone at home registering their home computer no ?

 

Cheers

 

S

[DrCheese]

Having devices "registered" is a non issue - It just allows you greater control over how a device accesses corporate data, eg you can check for basics like device encryption or anti virus before allowing access to data & apply MAM policies on applications installed on that device (eg, insisting on a PIN to access corporate resources)

 

You can't take over a device & apply system-wide policies like you could if it was Hybrid or natively Azure AD joined. You have no visibility into user data on the device.

 

Think of it as just doing basic checking of a device before you allow it into your setup, like a nightclub bouncer checking if someone is carrying weapons/contraband & then recording who goes in.

[psydii]

You have no visibility into user data on the device.

 

You sometimes get their Bitlocker keys.

[Roberto]

Thanks for the input

 

But this wont stop someone at home registering their home computer no ?

 

Cheers

 

S

 

My apologies for my reply the other day. I've been looking into this since then and yeah, it looks like you can't prevent it. It seems odd to me, but there is actually a feature request for Microsoft to make this possible. You can prevent people enrolling devices in Intune, you can prevent them from signing in from their registered device, you can lock all that down, but it looks virtually impossible to prevent AAD registration.

[Scorpio]

My apologies for my reply the other day. I've been looking into this since then and yeah, it looks like you can't prevent it. It seems odd to me, but there is actually a feature request for Microsoft to make this possible. You can prevent people enrolling devices in Intune, you can prevent them from signing in from their registered device, you can lock all that down, but it looks virtually impossible to prevent AAD registration.

 

Yes, this looks to be because of Intune. As the slider Option is there but greyed out. I've tried al sorts to no avail. Like you say seems weird as surely it should be an option. Somebody could join a pc from any place. I know its not a huge deal but still surely we dont want random pcs showing up in there.

 

Cheers

 

S

[KK20]

why would you want a BYOD or home device to not register? For example I have an intune compliance policy that disallows rooted devices so all those pupils who try to connect their email to our system and have rooted phones are not allowed.

[pete]

You sometimes get their Bitlocker keys.

 

And it's typically the only place they're saved too.

 

@KK20

Kid goes to stay at Gran's house for the weekend.

Kid uses Gran's laptop to do homework.

Kid installs Office365 using school account to complete homework.

Kid says yes to "Allow My Organization To Manage My Device"

Device Encryption key on Gran's laptop gets changed from the clear default to an actual value.

Key gets uploaded to kid school's Azure AD.

Gran's computer is now encrypted with a key only known to the school.

Gran unaware.

[KK20]

Dont have a force encryption of registered devices. Only have one for joined devices.

[free780]

And it's typically the only place they're saved too.

 

@KK20

Kid goes to stay at Gran's house for the weekend.

Kid uses Gran's laptop to do homework.

Kid installs Office365 using school account to complete homework.

Kid says yes to "Allow My Organization To Manage My Device"

Device Encryption key on Gran's laptop gets changed from the clear default to an actual value.

Key gets uploaded to kid school's Azure AD.

Gran's computer is now encrypted with a key only known to the school.

Gran unaware.

 

Wouldn’t you need to force encryption via an intune compliance policy as a requirement?

 

Does the home SKU have bitlocker?

[pete]

@KK20 - we don't force encryption for registered devices.

 

They're encrypted at install with a clear text key in Windows 11 (and later versions of Win 10) if there's a TPM chip present on the device. It's not clear what the behaviour is if someone upgrades from Win 10 > 11.

 

Once Windows has a place to store a recovery key safely off-device (by someone using an account registered with Azure AD for an Office install and not clearing the right checkboxes) that clear-text key is replaced with a real encryption key.

 

Now it's encrypted. Regardless of any policies set to "don't touch devices we don't own".

 

There's an /r/sysadmin thread reporting similar problems:

 

Wouldn’t you need to force encryption via an intune compliance policy as a requirement?

 

Does the home SKU have bitlocker?

 

No. Affected devices don't appear in InTune, or admin.microsoft.com > Devices. They only appear in Azure AD > Devices.

 

Look at the list of devices, pick something you don't recognise running Windows 11 (version higher than 10.0.19045) and look to see if there's a Bitlocker key.

[KK20]

urgh. no filter for operatingsystemversion. I exported a CSV, started at the 10.0.22000 for azure ad registered and searched for the first 6. Nothing in the keys. I could use graph for https://learn.microsoft.com/en-us/graph/api/bitlocker-list-recoverykeys?view=graph-rest-1.0 but im too busy at the moment. perhaps none of our students/staff are affected for whatever reason, perhaps hybrid behaves differently (our onsite laptops do not have their keys listed in azure AD, only in on-prem AD), perhaps I picked 6 that had no TPM.

 

If it becomes an issue for us then I will create a powershell script and tack it onto our housekeeping scheduler. I will keep a database of deviceID that I have emailed, periodically download the graphapi bitlocker keys, email the username first registered with the device and send the bitlocker key with an explanation of why im emailing them then update my database to say ive contacted for that device id. Problem solved from my part.

 

If it truly bothers then im not sure if you can lock down a conditional access to block apps access, that way they cant azure register - browser only.

Edited November 23, 2022 by KK20

[pete]

Filtering the CSV by Win 11 and devices not owned by us (we have predictabled and reasonably unique name prefixes), about 4 of the latest 12 devices to register on one of our tenancies were affected.

 

Whether some of the kids are paying attention when prompted but a small amount aren't I'm not sure.