• Article
  • 2 minutes to read

The goal of Azure Ad registered devices is to provide your users with support for bring your own device (BYOD) or mobile device scenarios. In these scenarios, a user tin access your arrangement'due south resource using a personal device.

Azure AD Registered Description
Definition Registered to Azure Advert without requiring organizational account to sign in to the device
Primary audition Applicable to all users with the following criteria:
Bring your own device
Mobile devices
Device ownership User or System
Operating Systems Windows 10 or newer, iOS, Android, and macOS
Provisioning Windows 10 or newer – Settings
iOS/Android – Company Portal or Microsoft Authenticator app
macOS – Company Portal
Device sign in options End-user local credentials
Password
Windows Hullo
PIN
Biometrics or blueprint for other devices
Device management Mobile Device Direction (example: Microsoft Intune)
Mobile Application Management
Key capabilities SSO to cloud resources
Conditional Admission when enrolled into Intune
Provisional Admission via App protection policy
Enables Phone sign in with Microsoft Authenticator app

Azure AD registered devices

Azure AD registered devices are signed in to using a local account like a Microsoft business relationship on a Windows 10 or newer device. These devices take an Azure Advertizing account for admission to organizational resource. Access to resource in the organization can be limited based on that Azure AD account and Conditional Access policies applied to the device identity.

Administrators tin can secure and farther control these Azure Ad registered devices using Mobile Device Management (MDM) tools similar Microsoft Intune. MDM provides a means to enforce organization-required configurations like requiring storage to be encrypted, password complexity, and security software kept updated.

Azure Advertising registration can be accomplished when accessing a work application for the first time or manually using the Windows 10 or Windows 11 Settings menu.

Scenarios

A user in your organization wants to access your benefits enrollment tool from their dwelling house PC. Your organization requires that anyone accesses this tool from an Intune compliant device. The user registers their home PC with Azure AD and the required Intune policies are enforced giving the user admission to their resources.

Another user wants to access their organizational email on their personal Android phone that has been rooted. Your company requires a compliant device and has created an Intune compliance policy to cake any rooted devices. The employee is stopped from accessing organizational resources on this device.

Next steps

  • Manage device identities using the Azure portal
  • Manage stale devices in Azure AD
  • Annals your personal device on your piece of work or school network