Blog Series February 6, 2024 4

Blog Series: Unmanaged Devices

Welcome to my blog series on the topic of unmanaged devices!

More and more users are working from unmanaged devices than ever before. But unfortunately, because of this trend, risks are also rapidly increasing. If we don’t implement security measures for these devices, malware infections, successful phishing attacks, exploited vulnerabilities, and data leaks will happen more frequently and easily.

It’s not hard to guess why because these unmanaged devices have fewer security controls enabled to prevent such risks. In 2023, nearly nine out of ten successful ransomware attacks were carried out through unmanaged devices. Also, recently, we have seen the rise of QR Code Phishing. This new attack targets users scanning malicious QR codes from (mostly unmanaged and unprotected) mobile devices. 

Even without considering cyberattacks, allowing users to access and download sensitive data onto their personal devices is a considerable risk. If such a device is lost or stolen, or if the user quits or loses their job, the data will remain on the device without the ability for the company to wipe it. 

Luckily, Microsoft offers many solutions to manage these risks. For example, managing company data, requiring endpoint protection, and limiting access from unmanaged devices. The best part is that you don’t even have to fully manage the device.

Blog posts

Here is a list of previously written and planned posts for the unmanaged devices blog series. In this series, I’ll discuss various strategies and methods to reduce security risks when dealing with unmanaged devices. I will continue to update old posts and write new posts until I have covered the topic.

Part 1: Limited access with Conditional Access for Unmanaged Devices
Part 2: Limited access with Sensitivity Labels for Unmanaged Devices
Part 3: Limited access with Session Policies for Unmanaged Devices
Part 4: Block access with Conditional Access for Unmanaged Devices
Part 5: First Look at Mobile Application Management (MAM) for Windows
Part 6: Mobile Application Management (MAM) for personal Android & iOS Devices
Part 7: Microsoft Defender (MDE) for personal Android & iOS with MAM
Part 8: Quick guide: How to disable personal device enrollments in Microsoft Intune
Part 9: How to manage secure access for external admins
Part 10: Quick Guide: How to enable device trust for guest users
Part 11: First look at In-Browser Protection with Edge for Business
Part 12: (coming soon)
Part 13: (coming soon)
Part 14: (coming soon)
Part 15: (coming soon)

Besides the posts listed above, I have a couple more planned that I am not ready to reveal yet.

Wrap up

If you have any suggestions for new posts in this series, feel free to leave a comment, and I’ll gladly consider them.

Blog Series: Unmanaged Devices

About the author

Myron Helgering:

4 Comments

  1. Pavan

    February 9, 2024
    Reply

    Hello There,
    Excellent guides really appreciate your efforts publishing them.
    For some reason part4&10 are not accessible and want to check if you are still writing them etc?
    Thanks,
    Pavan

    • Myron Helgering

      February 9, 2024
      Reply

      Hey Pavan!
      I'll be publishing parts 4, 6, and 10 soon, and I have plans for at least six more parts this year.
      I'll keep this page updated with all new blog posts, quick guides, and other unmanaged devices content. Have a great day!

  2. Roeland C.

    June 5, 2024
    Reply

    Very good that you publish your methods to answer these very important questions. Some (for me) brain cracking questions from customers:

    How to block transfer of corp. onedrive files from the corp.PC, through USB, or via a second onedrive running on the device ?

    How to block access to onedrive files after a user is AD disabled, deleted ? PC must be AAD joined, must have BitLocker, short time cached creds,

    • Hello Roeland!

      The answer to your first question would be Windows Information Protection for managed devices, but this solution is being deprecated, so I would not advise you to go that route.

      Your only other option would be to look at Endpoint DLP (Data Loss Prevention); this can prevent (sensitive) data from being transferred to other cloud apps, USB disks, and file shares.

      I am not completely sure I understand your second question, but disabling the on-prem (synced) user would disable sign-in for the cloud user. If you need to quickly remove a user session, you can revoke all user sessions from Entra ID.

      I hope that answers your questions; if not, let me know.

Would you like to share your thoughts?

Your email address will not be published. Required fields are marked *

Leave a Reply