Enrollment Device Platform Restrictions & MDM Scope

Control which platforms (Windows, iOS, Android, macOS) and ownership types (Corporate vs Personally-Owned BYOD) are permitted to enroll into Microsoft Intune.

Tags:#Enrollment Restrictions#MDM User Scope#BYOD#Platform Restrictions#Intune#MD-102

Overview

Enrollment Device Platform Restrictions define the admission gate for devices attempting to enroll into Microsoft Intune. Administrators can enforce platform-level controls (block Windows, Android, iOS, macOS), configure minimum/maximum allowable OS build versions, and restrict personally-owned (BYOD) devices from enrolling into MDM management.

Coupled with MDM User Scope configured in Microsoft Entra ID, this ensures only authorized users and supported operating systems can register enterprise endpoints.

---

When to Use

Scenario	Recommendation	Technical Rationale
Block Personal BYOD Windows Laptops	Mandatory	Prevent users from enrolling unmanaged home PCs into Intune; enforce MAM/WIP or require corporate Autopilot registration.
Enforce Minimum OS Version at Enrollment	Recommended	Block legacy unpatched Windows builds (e.g., block builds below Windows 10 22H2 / Windows 11 23H2).
Pilot Testing Scope	Recommended	Target MDM enrollment to a specific pilot Entra ID Security Group before expanding tenant-wide.

---

Prerequisites

Roles: Intune Administrator or Global Administrator.
Licenses: Microsoft Intune Plan 1 or Microsoft 365 Business Premium / E3 / E5.
Entra Configuration: MDM User Scope configured in Microsoft Entra Admin Center.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Enrollment
        └── Device platform restrictions
            └── Windows restrictions (Default or Custom Priority)

---

Step-by-Step Implementation

Step 1: Configure Microsoft Entra MDM User Scope

Navigate to Microsoft Entra Admin Center (entra.microsoft.com) > Identity > Mobility (MDM and WIP) > Microsoft Intune.
Set MDM user scope: All (or target a security group, e.g., SG-Intune-Enrolled-Users).
Set WIP user scope: None (Windows Information Protection is deprecated).

Step 2: Create Custom Device Platform Restriction in Intune

In Intune Admin Center > Devices > Enrollment > Device platform restrictions.
Select Windows restrictions > Click Create restriction.
Configure platform properties:

MDM: Allow
Min version: 10.0.22631 (Requires Windows 11 23H2 or newer)
Personally owned (BYOD): Block (Only corporate devices with Autopilot hardware hash or corporate identifiers can enroll).

Assign to target users: SG-Corporate-Employees.
Set rule priority: Custom rules take precedence over the All Users (Default) baseline.

---

PowerShell Commands

Query Corporate vs Personal Device Ownership via Graph SDK:

PowerShell

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

# Query Intune devices filtered by ownership type
Get-MgDeviceManagementManagedDevice -All | 
    Select-Object deviceName, userPrincipalName, operatingSystem, osVersion, deviceOwnership, managedDeviceOwnerType | 
    Format-Table -AutoSize

Identify Blocked Enrollment Attempts:

PowerShell

# Query enrollment failure events in Graph
Get-MgDeviceManagementEnrollmentTroubleshootingEvent -Top 10 | 
    Select-Object eventDateTime, userId, deviceId, failureCategory, failureReason | 
    Format-List

---

Verification Checklist

VERIFICATION CHECKLIST

0/4 (0%)

High-priority restriction policy assigned to corporate employee group.

Attempting to enroll a personal Windows PC via Settings > Access work or school fails with error code 0x80180014.

Autopilot corporate devices register seamlessly without restriction blocks.

Minimum OS version blocks devices running unsupported or end-of-life builds.

Troubleshooting Matrix

Error Code	Root Cause	Exact Resolution
`0x80180014` (Platform blocked)	Personally-owned devices blocked by enrollment restriction policy, or user not in MDM scope.	If device is corporate, ensure its serial number is pre-imported as an Autopilot device or Corporate Device Identifier.
`0x80180005` (Device cap exceeded)	User account has reached the maximum allowed device limit in Entra ID (default 50).	Go to Entra ID > Devices > Device Settings > Clean up stale devices for the user account.
`0x80180003` (License error)	Target user attempting enrollment does not possess an assigned Intune license.	Assign a Microsoft 365 E3/E5 or Intune Plan 1 license in Microsoft 365 Admin Center.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Traps:

Default vs Custom Priority: The default policy always applies to All Users and has the lowest priority (cannot be deleted). Custom policies have priority numbers (1, 2, 3...) where 1 is the highest priority.
BYOD Block Impact: Blocking personally owned devices does NOT block Autopilot devices, because Autopilot devices are recognized as Corporate upon hardware hash validation.
MDM Scope vs WIP Scope: In Entra ID, if both MDM and WIP scopes are assigned to the same user, MDM enrollment takes precedence for device management.

PREVIOUS TOPIC1.2 Windows Autopilot: Self-Deploying Mode & Kiosks NEXT TOPIC1.4 Windows Autopilot: Pre-Provisioned Deployment