BYOD considerations

MAM and MDM scope -

If you want to restrict who can enroll devices - Link
Limit the MDM scope -



Note - MDM scope must be set to an Azure AD group that contains USER objects









AAD_Sec_User_BYOD_Windows

Create groups -

AAD_Sec_User_BYOD_Windows
AAD_Sec_User_BYOD_iOS
AAD_Sec_User_BYOD_Android

AAD_Sec_Device_BYOD_Windows
AAD_Sec_Device_BYOD_iOS
AAD_Sec_Device_BYOD_Android


Enrollment restrictions -