Back to Checks
Maximum number of devices per user is limited
entra_device_registration_max_devices_per_user_limited
Service: entraSeverity: low
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined
The tenant device registration policy should limit the maximum number of Microsoft Entra joined or registered devices per user to 10 or less (userDeviceQuota). Once the limit is reached, no additional devices can be added until existing ones are removed.
ProwlerRisk
An unbounded or high per-user device quota lets a compromised account register many devices, increasing the number of trusted endpoints an attacker controls and complicating device lifecycle governance.
Run this check with Prowler
Run in Prowler CloudRun
prowler m365 --checks entra_device_registration_max_devices_per_user_limitedRecommendation
Set the maximum number of devices per user to 10 or less to bound the number of trusted endpoints each identity can register.
Remediation
Other
1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Devices** > **Device settings**
3Set **Maximum number of devices per user** to **10** or less
4Click **Save**
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
# CIS recommends a maximum of 10 devices per user (or less).
MAX_DEVICES_PER_USER = 10
class entra_device_registration_max_devices_per_user_limited(Check):
"""Check if the maximum number of devices per user is limited.
The device registration policy should set the maximum number of Entra joined or
registered devices per user to 10 or less.
- PASS: The maximum number of devices per user is 10 or less.
- FAIL: The maximum number of devices per user is greater than 10 (or unlimited).
"""
def execute(self) -> List[CheckReportM365]:
"""Execute the per-user device quota limit check.
Returns:
List[CheckReportM365]: A list containing the result of the check.
"""
findings = []
policy = entra_client.device_registration_policy
if not policy:
return findings
report = CheckReportM365(
metadata=self.metadata(),
resource=policy,
resource_name="Device Registration Policy",
resource_id="deviceRegistrationPolicy",
)
quota = policy.user_device_quota
report.status = "FAIL"
if quota is None:
report.status_extended = (
"The maximum number of devices per user is not limited, exceeding "
f"the recommended limit of {MAX_DEVICES_PER_USER}."
)
else:
report.status_extended = (
f"The maximum number of devices per user is {quota}, which exceeds "
f"the recommended limit of {MAX_DEVICES_PER_USER}."
)
if quota is not None and quota <= MAX_DEVICES_PER_USER:
report.status = "PASS"
report.status_extended = (
f"The maximum number of devices per user is {quota}, within the "
f"recommended limit of {MAX_DEVICES_PER_USER}."
)
findings.append(report)
return findings