Our organization has not approved a policy requiring access to Azure resources, such as Windows 365 Cloud PCs, to come only from company-owned and managed devices. Management still wants employees to use personal computers, but we would like to use Conditional Access to require a recognized device type and improve protection against stolen tokens. The options are Entra registered, Entra joined, or Entra hybrid joined. What is the most appropriate approach if we want to avoid managing employees' personal computers and only use device status as a condition for accessing company resources?
4 Answers
Entra registered by itself provides very little additional assurance. A user who has valid credentials can usually register another device, so registration does not prove that the computer is secure or trusted. Entra joined or hybrid joined is more meaningful when the device is managed and its security posture is verified. Without management, you are effectively trusting an unmanaged device just because it was registered.
For personally owned devices, the practical Microsoft-supported model is to register the device and enroll it in Intune, then use compliance-based Conditional Access. That lets you check things such as encryption, patching, antivirus, and other security requirements, but it is still device management. There is not really a trustworthy middle ground where a personal computer is unmanaged yet treated as a trusted joined device.
If the goal is protecting sensitive resources, keep full access limited to managed and compliant devices. For BYOD, consider browser-only access with phishing-resistant MFA and restrictions on downloads or local synchronization. Allowing full Outlook, OneDrive, or SharePoint synchronization from unmanaged personal computers creates considerably more risk than browser access.
You can use device filters or specific device IDs to control access for registered devices, but that is mainly an allowlist mechanism, not proof that the device is secure. An attacker with compromised credentials could potentially register another device and try to use it. For administrative portals and other high-value applications, company-managed compliant devices are the safer requirement.
That makes sense. The Conditional Access policy I was considering allows Entra joined and hybrid joined devices, but not merely Entra registered devices. I was hoping there was a way to use that distinction without managing personal computers.