AADDeviceRegistrationPolicy

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
IsSingleInstance	Key	String	Only valid value is 'Yes'.	Yes
AzureADJoinIsAdminConfigurable	Write	Boolean	Determines whether or not administrators can configure Azure AD Join.
UserDeviceQuota	Write	UInt32	Specifies the maximum number of devices that a user can have within your organization before blocking new device registrations. The default value is set to 50. If this property isn't specified during the policy update operation, it's automatically reset to 0 to indicate that users aren't allowed to join any devices.
AzureADAllowedToJoin	Write	String	Scope that a device registration policy applies to.	All, Selected, None
AzureADAllowedToJoinUsers	Write	String[]	List of users that this policy applies to.
AzureADAllowedToJoinGroups	Write	String[]	List of groups that this policy applies to.
AzureADRegistration	Write	MSFT_AzureADRegistrationPolicy	Specifies the authorization policy for controlling registration of new devices using Microsoft Entra registered.
MultiFactorAuthConfiguration	Write	String	Specifies the authentication policy for a user to complete registration using Microsoft Entra join or Microsoft Entra registered within your organization. The possible values are: notRequired, required, unknownFutureValue. The default value is notRequired.	notRequired, required
LocalAdminsEnableGlobalAdmins	Write	Boolean	Indicates whether global administrators are local administrators on all Microsoft Entra-joined devices. This setting only applies to future registrations. Default is true.
AzureAdJoinLocalAdminsRegisteringMode	Write	String	Scope that a device registration policy applies to for local admins.	All, Selected, None
AzureAdJoinLocalAdminsRegisteringGroups	Write	String[]	List of groups that this policy applies to.
AzureAdJoinLocalAdminsRegisteringUsers	Write	String[]	List of users that this policy applies to.
LocalAdminPasswordIsEnabled	Write	Boolean	Specifies whether this policy scope is configurable by the admin. The default value is false. An admin can set it to true to enable Local Admin Password Solution (LAPS) within their organzation.
Credential	Write	PSCredential	Credentials of the Admin
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
ApplicationSecret	Write	PSCredential	Secret of the Azure Active Directory tenant used for authentication.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for CertificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Embedded Instances

MSFT_AzureADRegistrationPolicy

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
AllowedToRegister	Write	MSFT_DeviceRegistrationMembership	Determines if Microsoft Entra registered is allowed.
IsAdminConfigurable	Write	Boolean	Determines if administrators can modify this policy.

MSFT_DeviceRegistrationMembership

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Groups	Write	String[]	List of groups that this policy applies to.
Users	Write	String[]	List of users that this policy applies to.
odataType	Write	String	The type of the entity.	#microsoft.graph.allDeviceRegistrationMembership, #microsoft.graph.enumeratedDeviceRegistrationMembership, #microsoft.graph.noDeviceRegistrationMembership

Description

Represents the policy scope that controls quota restrictions, additional authentication, and authorization policies to register device identities to your organization.

Permissions

Graph

To authenticate with the Graph API, this resource requires the following permissions:

Delegated permissions

• Read

• Policy.Read.DeviceConfiguration, GroupMember.Read.All

• Update

• Policy.ReadWrite.DeviceConfiguration, GroupMember.Read.All

Application permissions

• Read

• Policy.Read.DeviceConfiguration

• Update

• Policy.ReadWrite.DeviceConfiguration

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AADDeviceRegistrationPolicy "AADDeviceRegistrationPolicy-Example"
        {
            AzureADAllowedToJoin                    = "Selected";
            AzureADAllowedToJoinGroups              = @();
            AzureADAllowedToJoinUsers               = @("AlexW@M365x73318397.OnMicrosoft.com");
            AzureAdJoinLocalAdminsRegisteringGroups = @();
            AzureAdJoinLocalAdminsRegisteringMode   = "Selected";
            AzureAdJoinLocalAdminsRegisteringUsers  = @("AllanD@M365x73318397.OnMicrosoft.com");
            AzureADRegistration                     = MSFT_AzureADRegistrationPolicy{
                AllowedToRegister   = MSFT_DeviceRegistrationMembership{
                    Groups    = @()
                    Users     = @()
                    odataType = "#microsoft.graph.allDeviceRegistrationMembership"
                }
                IsAdminConfigurable = $False
            };
            IsSingleInstance                        = "Yes";
            LocalAdminPasswordIsEnabled             = $False;
            LocalAdminsEnableGlobalAdmins           = $True;
            MultiFactorAuthConfiguration            = "required";
            UserDeviceQuota                         = 50;
            ApplicationId                           = $ApplicationId;
            TenantId                                = $TenantId;
            CertificateThumbprint                   = $CertificateThumbprint;
        }
    }
}