12

The following dialog is displayed after entering credentials in Outlook for an Office 365 subscription with multi-factor authentication enabled:

Use this account everywhere on your device

Use this account everywhere on your device

Windows will remember your account and make it easier to sign in to apps and websites. You won't have to enter your password each time you access your organization's resources. You may need to allow them to manage certain settings on your device.

Allow my organization to manage my device

  1. What happens if "Yes" is selected when the "Allow my organization to manage my device" checkbox is selected?
  2. What happens if "Yes" is selected when the "Allow my organization to manage my device" checkbox is not selected?

It appears like option 1 (selecting Yes with the checkbox selected) results in the device being registered with Azure AD.

2 Answers 2

10

Yes, you are correct. Selecting the option to allow my organization to manage my device registers your device in your organization’s Azure AD. It is called Workplace Join.

It doesn’t mean much else than that. It will receive a certificate and it will be a recognized device. Some basic information about your computer will be registered in AD, such as OS type and version.

Should you use that device to access your organization’s Office 365 services, certain policies may take effect, like bypassing multi-factor authentication. Single sign-on may take effect allowing you to access other services your organization offers without having to sign in again. These are defined by your organization admins.

If you click Yes, as opposed to “this app only,” you will be signed in to your organization across multiple different Microsoft apps, like all Office applications.

If you choose not to use this option to allow your device to be managed, you will be prompted for authentication and possibly multi-factor authentication periodically. Depending on your organization’s policies, you may be unable to access certain services.

2

This settings can also break things in Windows/Office.

In Office, having your company email address added to this setting can prevent you from successfully changing your password for Office programs on the device if your Office 365 account password is changed.

It can also (I found out this morning) cause network shared drive to think the files are encrypted when they are not, preventing access to or copying of data from the network drives.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .