We allow personal iOS and Android devices to access our Microsoft 365 environment through Outlook and Teams. These devices are Microsoft Entra registered, and we need to prepare an audit inventory of the mobile devices that are actually being used to access company resources. What is the best way to distinguish registered devices from devices with recent Outlook or Teams activity?
4 Answers
If unmanaged access is currently allowed, there may not be a complete inventory to discover. Conditional Access can require compliant or managed access, but for BYOD many organizations use app protection policies, or MAM, instead of managing the entire personal phone. That gives you better control over company data without requiring full device enrollment.
Start with the Microsoft Entra device list and filter the join type to Entra registered. Export the results, then compare them with Entra sign-in logs filtered for Teams and Outlook on iOS or Android. That gives you a useful list of registered devices associated with recent app access, although you may need to match users and device identifiers manually.
Check the Microsoft 365 usage reports first. They can show which users are accessing Teams or Outlook from mobile devices, which is useful for identifying actual usage at the user level. For device-level details, combine that information with Entra sign-in logs and, if applicable, Exchange Online mobile device data such as the results from Get-MobileDevice.
Be careful not to treat device registration as proof that the device is actively being used. A registered personal device may be old or unused, while users can sometimes sign in from unmanaged devices without creating a useful device record. Review sign-in and audit logs, including the application, platform, user, device information, and sign-in date.
MAM is often a practical compromise for personal phones, but it still does not replace reviewing sign-in activity when the audit asks which devices were actually used.