Preventing users from carrying out Entra ID device registration

To block your users from adding additional work accounts to your corporate domain-joined, Entra ID joined, or Hybrid Entra ID Joined Windows devices, enable the following registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin, "BlockAADWorkplaceJoin"=dword:00000001.

This registry key can also be used to block domain-joined machines from inadvertently getting Entra ID registered with the same user account:

Figure 13.29: Use this account everywhere on your device

There is no central way to prevent a user from registering their BYOD device in Entra ID. If Entra ID automatic MDM enrollment is configured and the box for Allow my organization to manage my device is checked, the device will be enrolled into Microsoft Intune. Next, we will take a look at Self-service Password Reset (SSPR).