Picture it. First week back in September. You switched on automatic enrolment over the summer, tested it on a couple of laptops, and everything landed in Intune exactly as planned. You even had a celebratory brew.
Then you open All devices and find a machine called DESKTOP-GAMER-RGB. Next to it sits “Mia’s iPad”, a Samsung nobody can account for, and a laptop whose owner seems to be the entire maths department. Nobody hacked anything. Staff just did exactly what the setup screen invited them to do.
You never told Intune who was allowed in. So it let everyone in.
Out of the box, Intune lets any licensed user enrol pretty much any device, personal ones included, up to the default device limit. Fine in a lab. Less fine when a member of staff enrols their kid’s laptop and it starts getting BitLocker policies.
Intune enrollment restrictions are the bouncer on the door, and they come in two kinds. One decides what gets in. The other decides how many. Below, I’ll block personal Windows devices, set sensible device limits for staff, students and IT, and cover the gotchas that catch people out.
The short version
- Device platform restrictions control which platforms can enrol, which OS versions, and whether personally owned devices get in. Blocking personal Windows devices is the one most schools want.
- Device limit restrictions cap how many devices one user can enrol, from 1 to 15. They don’t count Autopilot, Entra joined or co-managed Windows devices, so they mostly bite on phones and tablets.
- Each type has a Default that covers everyone. Your own restrictions sit above it, and the highest one that applies to a user wins. No merging.
- Custom restrictions only apply to user-driven enrolments. Userless ones (co-management, self-deploying Autopilot and friends) only ever see Default.
In this post
How Intune enrollment restrictions work
Enrollment restrictions are checked once, at the moment a device tries to enrol. Pass, and it enrols. Fail, and it’s turned away with an error. They don’t touch anything that’s already enrolled.
There are two types, and they live in two separate lists in the Microsoft Intune admin center under Devices > Device onboarding > Enrollment:
- Device platform restriction: one list per platform, with tabs for Windows, Android, macOS, iOS and so on.
- Device limit restriction: one list covering every platform.
Each list has a Default restriction. You can edit it but not delete it, and it always sits at the bottom. Anything you create lands above it and only applies to the user groups you assign. When a user is in the groups for more than one restriction, the highest one in the list wins and the rest are ignored completely. It’s not like compliance, where settings combine.
Not a security control. Microsoft says this plainly in the docs and it’s worth taking on board. A determined user can make a device lie about what it is. Enrollment restrictions stop honest mistakes. Conditional Access and app protection policies are what stop the dishonest ones.
Before you start
- Permissions: creating, editing and reordering restrictions needs the Intune Administrator role in Entra. The built-in Intune roles only get read access.
- Licensing: nothing extra to buy. Enrollment restrictions are part of Intune Plan 1, the base plan, which comes with most Microsoft 365 bundles that include Intune, such as Microsoft 365 E3, E5 and Business Premium, and Microsoft 365 A3 and A5 for education. Anyone enrolling a device needs an Intune licence.
- Automatic enrolment set up if you’re doing Windows. I covered that in Intune Automatic Device Enrollment in 6 Easy Steps.
- User groups, not device groups. Restrictions are checked against the user doing the enrolling, so every assignment is a user group.
- Your corporate kit registered. Before you block personal devices, make sure Intune can tell which ones are yours. More on that in Part 1.
Here’s what’s set up in my lab, and who each restriction is assigned to.
| Restriction | Type | Setting | Who it’s for |
|---|---|---|---|
| Device Platform Restrictions – Pilot | Platform (Windows) | Personally owned: Block | Users – Enrollment Pilot while testing |
| Device Platform Restrictions – IT Exception | Platform (Windows) | Personally owned: Allow | Users – IT Support |
| Device Limit Restrictions – Staff | Device limit | 5 | Users – Staff |
| Device Limit Restrictions – Students | Device limit | 2 | Users – Students |
| Device Limit Restrictions – IT Staff | Device limit | 10 | Users – IT Support |
| All users and all devices (Default) | Device limit | 5 | Everyone not in a group |
Tip: pick a naming pattern and stick to it. I use the restriction type, then who it’s for. When the list grows, you can tell what each one does and who it’s for without opening it.
Part 1: Device platform restrictions
A device platform restriction answers one question: is this kind of device allowed to enrol at all? For Windows there are three settings:
- MDM: allow or block Windows enrolment entirely.
- Allow min/max range: a minimum and maximum OS version. Microsoft Learn says version limits only apply to Company Portal enrolments on Android and iOS, but the portal’s own text says the same for Windows. Test it before you rely on it, and use build numbers such as 10.0.26100 rather than names like 24H2.
- Personally owned devices: allow or block devices Intune thinks are personal.
What Intune counts as corporate
When you block personal Windows devices, Intune only lets through enrolments it can prove are corporate:
- Windows Autopilot
- Co-management from ConfigMgr, or GPO enrolment
- A bulk provisioning package
- A device enrollment manager (DEM) account
- A device that matches one of your Corporate device identifiers
This is the bit that catches people. An unregistered laptop doing a plain Entra join, during setup or from Settings, gets blocked, even though Intune would normally mark it as corporate. The same goes for Autopilot for existing devices, and for Autopilot device preparation unless the device is in your corporate identifiers or set up with device association (physical Windows 11 devices with TPM 2.0 only, so not your test VMs). The user sees an error during setup (often 80180014) and you get a ticket.
The fix is to tell Intune about your kit before it arrives. Register it in Windows Autopilot, or upload its manufacturer, model and serial number under Corporate device identifiers. Windows corporate identifiers need Windows 11 22H2 build 22621.3374 or later, or Windows 10 22H2 build 19045.4598 or later.
Everything a user does on a personal machine gets blocked: Add work account in Settings, the MDM-only option, Company Portal, and ticking Allow my organization to manage my device when signing in to a Microsoft 365 app. That’s the point.
Block personal Windows devices (pilot first)
Don’t start with Default. Build a custom restriction, pilot it with a handful of users, and only change Default once you’ve watched real enrolments go through.
- In the Microsoft Intune admin center, go to Devices > Device onboarding > Enrollment.
- On the Windows tab, select Device platform restriction.
- On Windows restrictions, select Create restriction.
- On Basics, name it Device Platform Restrictions – Pilot and add a description that says who it’s for. Platform is already set to Windows 10 and later. Select Next.
- On Platform settings, leave MDM on Allow and set Personally owned devices to Block. Leave Allow min/max range empty.
- Select Next, add scope tags if you use them, then select Next again.
- On Assignments, select Add groups and pick Users – Enrollment Pilot. Resist Add all users for now.
- Select Next, check it on Review + create, then select Create.
Add an exception for IT
IT are the people most likely to need an unregistered or personal Windows device enrolled, usually for testing. Give them their own restriction rather than weakening the rule for everyone.
- Create another Windows restriction called Device Platform Restrictions – IT Exception.
- Leave MDM and Personally owned devices both on Allow.
- Assign it to your IT staff group. Mine’s Users – IT Support.
- Make sure it sits above any restriction that blocks personal devices. Priority is covered further down.
Move the block into Default
Once the pilot’s clean, make blocking personal devices the rule rather than the exception. Open Default (it shows as All Users in the Windows list) and set Personally owned devices to Block. Then delete the pilot restriction so you’re not maintaining two copies of the same rule.
Why Default and not a custom restriction assigned to all users? Default is the only one that covers people who aren’t in any group, plus every userless enrolment. Your IT exception still wins for IT, because anything you create sits above Default.
Good to know: the same thinking works for iPads and phones. Devices from Apple School Manager through Automated Device Enrollment count as corporate, so blocking personal iOS doesn’t touch your school iPads. If staff use their own phones through app protection policies without enrolling (which I’d recommend), you can block personal iOS and Android too. If you deliberately enrol staff phones with an Android work profile, leave personal Android allowed.
Part 2: Device limit restrictions
A device limit restriction caps how many devices one user can enrol, anywhere from 1 to 15. Simple enough, except it doesn’t count what most people assume it counts.
What actually counts towards the limit
These Windows enrolments don’t count at all. Intune treats them as shared devices and ignores the limit:
- Windows Autopilot
- Entra join, including bulk enrolment
- Co-management from ConfigMgr
- GPO enrolment
- Anything enrolled with a DEM account
These do count:
- Personal phones and tablets, including Android work profile and Apple User Enrollment
- Corporate mobiles with a user: Apple Automated Device Enrollment with user affinity, Android fully managed, and Android corporate-owned work profile
- Windows devices enrolled through Company Portal
So in practice this is a phone and tablet control. If you hand out Apple School Manager iPads with user affinity, they count against each person’s limit, which matters when you pick the numbers. Microsoft Learn contradicts itself on whether Add work account from Windows Settings counts, so don’t rely on it either way.
A device keeps counting until it’s deleted from Intune or hasn’t checked in for 90 days. Someone who swapped phones last month is probably still carrying the old one.
Good to know: there’s a second limit in Entra, Maximum number of devices per user, under Devices > Device settings in the Microsoft Entra admin center. It defaults to 50 and covers Entra joined and registered devices, Autopilot included, but not hybrid joined ones. This is the limit IT actually hit. With user-driven Autopilot, every laptop counts against whoever signs in during setup, so a technician building a batch of laptops runs out at 50. That’s why Microsoft’s own school deployment guide says education tenants often set it to Unlimited. For phones and tablets the two limits stack and the lower one wins, so Entra on 3 and Intune on 5 means users get 3.
What I’d set for staff, students and IT
| Group | Restriction | Limit | Why |
|---|---|---|---|
| Staff | Device Limit Restrictions – Staff | 5 | A school iPad, a work phone, a personal phone if you enrol them with a work profile, and room for a replacement while the old one ages out |
| Students | Device Limit Restrictions – Students | 2 | A 1:1 iPad plus a replacement. Shared iPads without user affinity don’t count |
| IT staff | Device Limit Restrictions – IT Staff | 10 | Test phones and iPads. Laptops built with Autopilot don’t count here |
| Everyone else | All users and all devices (Default) | 5 | A safety net for anyone not in a group |
What I’d pick: 5 for staff. 3 sounds tidy, but it’ll generate tickets once school iPads and replacements are counted. Giving staff their own restriction at 5, rather than relying on Default, means you can change one without touching everyone else. And if a group shouldn’t be bringing devices at all, that’s a job for a platform restriction, not a lower number.
Create the restrictions
Check what Default is set to first. Go to Devices > Device onboarding > Enrollment and select Device limit restriction. In my lab, All users and all devices is on 5.
- Select Create restriction.
- On Basics, name it using your pattern, for example Device Limit Restrictions – IT Staff, and add a description. Select Next.
- On Device limit, pick a number from the dropdown, then select Next.
- Add scope tags if you use them, then select Next.
- On Assignments, add the matching user group. Mine are Users – Staff, Users – Students and Users – IT Support. You can leave it empty while you build them all, but an unassigned restriction does nothing.
- Select Next, then Create.
- Repeat for Staff and Students.
When someone hits the limit, they get a message during enrolment telling them to remove a device first. The error behind it is DeviceCapReached. On Windows it usually shows up as 80180003, “This user is not authorized to enroll”, which sounds like a licensing problem but often isn’t. Check the user’s devices before you raise their limit.
Get the priority order right
New restrictions land just above Default. With one custom restriction that’s fine, but once you add exceptions, order matters. Number 1 is the highest priority: a user in groups for priority 2 and priority 5 gets priority 2 and nothing from priority 5.
- Go to Devices > Device onboarding > Enrollment and open the list you want to reorder: Device platform restriction (one tab per platform, such as Windows restrictions) or Device limit restriction.
- Find the row you want to move. The platform lists have a Priority column. The device limit list doesn’t, and there’s no option to add one under Columns, so the order of the rows top to bottom is the priority.
- Click and hold the row, then drag it up or down. Intune saves the new order as soon as you let go.
- Select Refresh and check the order stuck. In my lab, dragging failed with “Something went wrong” while the restrictions were unassigned, and worked once they were assigned to groups.
Default stays at the bottom whatever you do, and you can’t drag it.
Check your Intune enrollment restrictions are working
Test both sides. Most people check that the block works, then find out on Monday that it blocked the new laptops too. Before you start, make sure your test user is actually in Users – Enrollment Pilot. If they’re not, Default applies, the personal VM enrols, and you’ll spend an hour wondering why your restriction doesn’t work. Group changes can also take up to about 15 minutes to reach enrollment restrictions, so give it a few minutes after adding someone before you test.
- Corporate kit still gets in. Take a device that’s registered in Autopilot or matches a corporate identifier, and enrol it as j.cullen. It should go through as normal.
- Personal kit gets bounced. Spin up a VM Intune has never heard of and try a plain Entra join during setup as the same user. It should fail.
- Check why it failed. Don’t trust the message on the device, because it varies depending on where it failed. Go to Devices > Monitor > Enrollment failures, find the user and look at Failure reason. A restriction block shows as Enrollment restriction not met.
- Device limits. If you’ve got test phones, assign a low limit to a test user, enrol up to it, and check the next one gets the device cap message.
If the failure reason is something else, like licensing, your restriction isn’t the problem and you can stop staring at it.
Intune enrollment restrictions gotchas
Custom restrictions only see user-driven enrolments. Self-deploying and pre-provisioned Autopilot, bulk enrolment, co-managed devices, Azure Virtual Desktop, Windows 365, userless Apple Automated Device Enrollment and Android dedicated devices all get Default, full stop. If you’re co-managed like a lot of us, your custom Windows restriction never touches those devices. Check what’s coming through Default before you tighten it.
The version fields aren’t a clean-up tool. It’s tempting to set a minimum build to stop old Windows 10 machines getting in. The min/max range is only checked at enrolment. Anything already enrolled stays enrolled. Use a compliance policy for that.
Restrictions aren’t retrospective. Blocking personal devices today does nothing about the personal laptop that enrolled last month. Filter All devices by ownership and deal with what’s already there.
Windows 365 Link devices get caught. A personal block also blocks them, because they enrol as unknown. Add them as corporate identifiers, or create an allow restriction above the block that uses an assignment filter for Windows 365 Link.
Workplace join can trip over old Entra records. If a device was ever Entra joined to your tenant and someone tries to register it instead, it can get blocked. Delete the old device object in Entra first.
DEM accounts skip all of this. Device enrollment managers bypass restrictions entirely. Handy for bulk work, but know who has one.
There’s a cap. You can have up to 25 restrictions of each type. If you’re anywhere near that, your groups need a rethink, not more restrictions.
Should you bother?
Yes. Blocking personal Windows devices is ten minutes of work, and it stops the slow creep of random laptops into your tenant. Register your kit, pilot the block, give IT an exception, then move the block into Default.
Device limits are less exciting. They don’t touch your Autopilot laptops, so set staff, students and IT sensibly, put the IT exception on top, and move on. If IT are building laptops in bulk, check the Entra limit too.
If you’re still at the stage of getting devices in at all, start with Intune Automatic Device Enrollment in 6 Easy Steps and come back here.
Further reading
- What are enrollment restrictions? (Microsoft Learn)
- Create device platform restrictions (Microsoft Learn)
- Create device limit restrictions (Microsoft Learn)
- Understand Intune and Microsoft Entra device limit restrictions (Microsoft Learn)
- Identify devices as corporate-owned (Microsoft Learn)
Questions or a different experience? Find me on LinkedIn, I read every message.
ICT Manager, 20 years in IT, and still occasionally clicking Sync and hoping. I write about Intune, Autopilot and Entra the way I’d explain it over a brew: what it does, how to set it up, and what’ll catch you out. Videos at @thedeploymentguy on YouTube.
