Restrict it by limiting device join rights to the users or groups that genuinely need them, rather than leaving enrolment open across the tenant. Review the join setting regularly, test the intended user experience, and monitor for device joins from unexpected accounts or locations. Pair the control with device compliance and lifecycle management so unauthorised devices do not enter the tenant.
Which Entra ID setting actually controls device join?
The control lives in the device settings that define who is allowed to register or join a device to the tenant. The practical decision is not “can anyone join?” but “which users or groups should have that right by default,” because the setting determines who can bring a new endpoint into management, trust, and policy scope.
In most environments, the safest pattern is to keep the join permission narrow and deliberate, then treat exceptions as a conscious access decision rather than a convenience feature. That matters because device join is an enrollment gate, and once a device is accepted it can become a foothold for access, compliance evaluation, and conditional access decisions.
Link the setting to your broader identity control model, not just to endpoint administration. The Active Directory and Entra ID Hardening Guide is useful here because it frames Entra ID hardening as part of a larger identity boundary, including privileged groups, delegation, and hybrid identity.
How do you limit device join rights without breaking onboarding?
Start by assigning the join right only to the users or groups that genuinely need it, then validate the experience for those populations before tightening further. That usually means testing standard onboarding paths, helpdesk-assisted enrollment, and any self-service flows so you do not accidentally block legitimate first-use scenarios while closing open registration for everyone else.
A useful companion control is privileged role governance. If the join experience is being controlled through administrative roles or temporary privilege, the Privileged Identity Management (PIM) Guide helps with the distinction between standing access and time-bound activation, which is often the difference between a controlled exception and a permanently open join path.
For organisations that rely on managed device trust, pair join rights with posture checks so that a device is not merely joined, but also evaluated. The Device Trust and Posture Guide is relevant because it connects device registration to compliance signals, managed versus unmanaged devices, and posture-based access.
What should you watch for after you restrict device joins?
Restriction is only effective if you monitor the edge cases it creates. Watch for join attempts from unexpected accounts, unusual geographies, repeated failures from a small set of users, and sudden changes in the number of enrolled devices, because those are common signs that the policy is either being bypassed, misunderstood, or probed.
Also review whether device join rights are being used as a substitute for broader application or consent governance. When device enrollment and application onboarding are both loose, the tenant can accumulate unmanaged trust edges. The Entra ID Applications and Consent Guide is a useful adjacent reference because it covers how trust is extended through enterprise apps, consent policy, and revocation decisions.
Finally, treat hybrid identity paths as especially sensitive. If the environment includes sync, federated trust, or legacy join paths, a permissive device join policy can be combined with other identity weaknesses in ways that are harder to spot than a simple over-permissioned user account.
Risk and Threat Considerations
Overly broad device join rights create a low-friction path for unwanted endpoints to enter the tenant, which can weaken access controls, expand the number of trusted devices, and make policy enforcement less reliable. The same weakness can also be abused to blend an attacker-controlled device into a legitimate fleet, especially where device trust is used as a signal for downstream access decisions.
Failure mechanism: If join permissions are open or poorly reviewed, an account that should not be onboarding hardware can register a device, establish trust, and potentially gain access paths that were intended only for managed endpoints.
Impact: The tenant can accumulate shadow or untrusted devices, compliance signals become less meaningful, and incident response becomes harder because the organisation cannot confidently separate approved endpoints from attacker-introduced ones.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Device join gating depends on who is allowed to establish trusted access. |
| AC-6 — Least Privilege | Restricting join rights is a least-privilege access decision. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Monitoring unexpected joins requires review of join and enrollment activity. | |
| Recommendation — Restrict join rights to approved users and groups with explicit authentication control. Limit device join permissions to the smallest necessary user set. Review device join logs for unexpected accounts, locations, and patterns. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Join rights are an access-control rule governing who can enroll devices. |
| A.8.15 — Logging | Join monitoring depends on records of enrollment and trust changes. | |
| Recommendation — Define and enforce who may join devices to the tenant. Log device join events and investigate anomalous enrollment activity. | ||
Practitioner Guidance
What to verify: Confirm that the device join setting maps to a small, named population, and that emergency or onboarding exceptions are time-bound rather than permanent. Verify that the approved group still matches current business need after role changes, mergers, or workforce growth.
What good looks like: New device joins are predictable, reviewable, and attributable to the right user population, while unmanaged or unexpected joins are rare enough to stand out as alerts rather than normal noise.
Decision rule: If a device can join the tenant and immediately influence access decisions, treat join-right sprawl as an access-control issue, not just an endpoint administration setting.
Practitioner takeaway: The goal is not to make joining impossible, but to make it intentional, attributable, and aligned with the same privilege boundaries you would apply to any other trust-granting action.