INTUNE-013: Device enrollment restrictions
- Plataforma
- Entra ID / M365
- Categoría
- Intune / Endpoint Management
- Severidad
- Medium
- Pilar de Zero Trust
- Devices (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Device enrollment restrictions control which device types, platforms, and OS versions are allowed to enroll in Intune management. Without proper restrictions, users could enroll personal devices running unsupported or vulnerable operating system versions, expanding the attack surface. Enrollment restrictions also prevent unauthorized device types from gaining access to corporate resources through device management.
Valor recomendado
Block personally owned devices or limit to specific platforms; enforce minimum OS version requirements; limit per-user device enrollment count
Remediación
Review the device enrollment restrictions in Intune and configure platform-specific restrictions that align with your organization's supported device policy. Set minimum operating system version requirements for each platform and configure the maximum number of devices a single user can enroll to prevent abuse. If corporate-owned device enrollment is preferred, block personally owned device enrollment and direct users to use app protection policies for BYOD scenarios.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-3