I'm trying to replicate the old on-premises Active Directory behavior where each user can sign in only from assigned devices. For example, User A should be able to access Microsoft 365 apps and resources only from Computer A, Laptop A, and Cell Phone A—not from any other computer or phone.
I've been testing Conditional Access with device filters and policies that block access from unapproved devices, but the result is that access is blocked entirely. Device information also appears to be inconsistent, especially for browser sign-ins, and some Windows sign-ins do not report the device correctly on the first attempt.
Our users have a mixture of Microsoft 365 Basic, Standard, and Premium licenses. Business Premium is available for some users but not everyone. Is there a reliable way to enforce a per-user device restriction across Microsoft 365 for all users?
3 Answers
Conditional Access can limit access to trusted, registered, or compliant devices, but it is not really designed as a simple permanent user-to-computer lock. Browser sessions, mobile apps, device registration state, and sign-in methods can all affect whether the device ID is reported. You would also need to confirm that every affected user has the licensing required for the identity and Conditional Access features being used.
This is technically possible in some environments with Conditional Access and registered or compliant devices, but restricting every user to one specific set of devices becomes difficult to maintain. Start by checking the Entra sign-in logs with the policy disabled. If the sign-in’s device information is missing or marked unknown, a device-filter policy cannot reliably match it, so the user will usually be blocked.
We use Conditional Access to require registered devices, but assigning exactly one or two devices to each individual user would create a significant support and administration burden. If the business requirement is strict, consider managing the endpoints with Intune, requiring compliant devices, and using separate controls for corporate-owned phones and computers. Test the policies in report-only mode first and validate each client type before enforcing them.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures