MT.1070: Restrict device join to selected users/groups or none.

ID	MT.1070
Severity	Medium
Suite	Mito
Product	Entra ID
Feature	Device identity
Security area	Devices and endpoints
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-6 Least Privilege nist-800-53-r5:IA-3 Device Identification and Authentication
MITRE ATT&CK	T1098.005
Reads from	Microsoft Graph

What this checks and how to fix it

Description

Verifies that device join to Entra ID is restricted to selected users/groups or disabled entirely.

Why This Matters

Device join should be restricted because:

• Unauthorized Access: Unrestricted device join allows any user to connect personal or unmanaged devices to corporate resources.
• Data Leakage: Uncontrolled devices may not have proper security controls, increasing risk of data exposure.
• Compliance: Many regulatory frameworks require controlled device access to organizational resources.
• Shadow IT: Unmanaged devices bypass security policies and monitoring capabilities.
• Attack Surface: Each joined device represents a potential entry point for attackers.

Restricting device join to selected users/groups ensures only authorized devices with proper security controls can access organizational resources.

Remediation action

This setting can be changed via device settings in the Microsoft Entra or Azure portal or via Microsoft Graph API / Graph PowerShell Module.

Admin Portal:

1. Go to Entra Admin Center
2. Navigate to Devices → Device settings
3. Set Users may join devices to Microsoft Entra to Selected or None
   • If Selected, configure the specific users/groups that can join devices
   • If None, disable device join entirely
4. Click Save

Use the following PowerShell commands to restrict device join:

# Connect to Microsoft Graph with appropriate permissions
Connect-MgGraph -Scopes "Policy.ReadWrite.DeviceConfiguration"

# Option 1: Disable device join completely
$params = @{
    azureADJoin = @{
        allowedToJoin = @{
            "@odata.type" = "#microsoft.graph.noDeviceRegistrationMembership"
        }
    }
}

# Option 2: Restrict to selected users/groups
$params = @{
    azureADJoin = @{
        allowedToJoin = @{
            "@odata.type" = "#microsoft.graph.enumeratedDeviceRegistrationMembership"
            users = @("user1@domain.com", "user2@domain.com")
            groups = @("group-id-1", "group-id-2")
        }
    }
}

# Apply the policy
Update-MgPolicyDeviceRegistrationPolicy -BodyParameter $params

Related links

• Manage device identities in Entra ID
• Device registration policy in Entra ID

---

Mito check. Author: marcel-ngn. Open-source licences.