WorkspaceOne and Entra

[u/Gremlin256]

Hi,

We have linked up Workspace One UEM and Entra.

Has anyone who has done the registration between UEM and Entra, been Able to differentiate a device enrolled in UEM a BYOD or Corporate Owned Device in Entra?

Any ideas how to verify in Entra please :) submitted a feature request 6 months ago and no updates from them ..

Thank you for any suggestions!!!

[u/Unique_Inevitable_27]

I'd check the device's Ownership and Trust type attributes in Entra under the device properties, then compare those against what UEM is reporting. If the ownership value isn't being passed through the integration, you may need to verify the device registration/enrollment mapping in UEM rather than relying on Entra alone.

[u/Gremlin256 → u/Unique_Inevitable_27]

Worked with Omnissa support, top level, and they showed the values are being passed to Entra..

[u/trance2]

Look into the Partner Compliance integration and then use the “compliant” attribute to identify your devices in Entra

[u/Gremlin256 → u/trance2]

We have already have set up Partner Compliance and according to Entra Admin, he doesn't see the corporate value because Microsoft verbage is different from UEM and that's where the feature request comes in

[u/ollip79]

you want to make the distinction to not apply BYOD MAM policies on managed compliant devices? no way to do that on Android at the moment. only iOS has an app config signal.

[u/Gremlin256 → u/ollip79]

Do you know the app config for iOS please?

[u/atljoer]

I'm not sure the direct answer to your question but what's the goal? I helped numerous folks do CA in Entra with UEM.

[u/Gremlin256 → u/atljoer]

Goal is we don't want any BYOD devices in our environment. UEM sends all values to Entra but Microsoft being Microsoft does.not take that value.

Right now policy is in report only mode for all Android, iOS and macOS. If thr policy that says if the devices are compliant and one more value, made product, all Android devices will be taken in but cannot differentiate BYOD from corporate owned

[u/atljoer → u/Gremlin256]

Cant you effectively make a policy in EntraId which enforces Managed and Compliant devices? Then in UEM not allow BYOD.

[u/Gremlin256 → u/atljoer]

I wish , but I am not an admin where they are in bucket mode. I have to show proof for everything. If they make a change, it would affect the whole business environment which I understand.

[u/Feisty_Quarter_1319]

Since Entra isn't properly registering the "Corporate" value passed by Workspace ONE, you have to bypass the native ownership attribute and use a different identifier in your CA policies to block BYOD.

Entra often successfully receives the Enrollment Profile Name if your corporate devices are enrolled enrolled via automated device enrollment programs.

Apple Business Manager (ABM) for iOS/macOS or Android Enterprise (Fully Managed/Zero-Touch), you can use this in your CA policy.

• In UEM: Ensure your corporate enrollment profiles have a distinct, standard naming convention (e.g., "CORP_DEP_Profile" or "Android_FullyManaged").
• In Entra CA: Go to Conditions > Filter for devices.
• Set the rule: device.enrollmentProfileName -startsWith "CORP" (or whatever your naming convention is).
• Action: Grant access only if the device is marked compliant AND matches this filter. BYOD devices will not have this enrollment profile and will be blocked.

[u/Gremlin256 → u/Feisty_Quarter_1319]

Thank you!!

[u/Gremlin256 → u/Feisty_Quarter_1319]

This is what I have for Friendly Name Configuration

nameofcompany-{EnrollmentUser}-{DeviceSerialNumber}

When I do a test enrollment for myself , it comes up as:

nameofcompany-{EnrollmentUser}

However I have this flag disabled:

Set Device Name to Friendly Name