Control: 5.1.4.2 Ensure the maximum number of devices per user is limited
Description
This setting defines the maximum number of Microsoft Entra joined or registered devices that a user can have in Microsoft Entra ID. Once this limit is reached, no additional devices can be added until existing ones are removed. Values above 100 are automatically capped at 100.
The recommended state is 20 or less.
Remediation
To remediate using the UI:
- Navigate to
Microsoft Entra admin centerhttps://entra.microsoft.com/. - Click to expand
Entra ID>DevicesselectDevice settings. - Set
Maximum number of devices per userto20 (Recommended)or less.
Default Value
50
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v600_5_1_4_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v600_5_1_4_2 --shareSQL
This control uses a named query:
select tenant_id || '/' || id as resource, case when user_device_quota <= 20 then 'ok' else 'alarm' end as status, case when user_device_quota <= 20 then tenant_id || ' has maximum devices per user limited to ' || user_device_quota || ' (recommended: 20 or less).' else tenant_id || ' has maximum devices per user set to ' || user_device_quota || ' (recommended: 20 or less).' end as reason , tenant_id as tenant_idfrom azuread_device_registration_policy;