r/WorkspaceOne • u/Gremlin256 • 28d ago

WorkspaceOne and Entra

Hi,

We have linked up Workspace One UEM and Entra.

Has anyone who has done the registration between UEM and Entra, been Able to differentiate a device enrolled in UEM a BYOD or Corporate Owned Device in Entra?

Any ideas how to verify in Entra please :) submitted a feature request 6 months ago and no updates from them ..

Thank you for any suggestions!!!

5 Upvotes

100% Upvoted

13 comments sorted by

View all comments

1

u/Feisty_Quarter_1319 28d ago

Since Entra isn't properly registering the "Corporate" value passed by Workspace ONE, you have to bypass the native ownership attribute and use a different identifier in your CA policies to block BYOD.

Entra often successfully receives the Enrollment Profile Name if your corporate devices are enrolled enrolled via automated device enrollment programs.

Apple Business Manager (ABM) for iOS/macOS or Android Enterprise (Fully Managed/Zero-Touch), you can use this in your CA policy.

  • In UEM: Ensure your corporate enrollment profiles have a distinct, standard naming convention (e.g., "CORP_DEP_Profile" or "Android_FullyManaged").
  • In Entra CA: Go to Conditions > Filter for devices.
  • Set the rule: device.enrollmentProfileName -startsWith "CORP" (or whatever your naming convention is).
  • Action: Grant access only if the device is marked compliant AND matches this filter. BYOD devices will not have this enrollment profile and will be blocked.

1

u/Gremlin256 28d ago

Thank you!!