Define managed device

Forums › IT Pro and developers › Define managed device

xpd

Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#318544 28-Jan-2025 09:10

Not Googled a lot yet but seen a couple of posts that have me scratching my head...

What defines a managed device ?

We have an AD environment with 90% of devices managed by Intune. Obviously those Intune devices are managed, but would you class the standard AD joined systems as managed as well.....

I ask as I'm looking at making some changes for security and one of the items is to restrict access to "managed devices only"........

To my mind, AD joined systems are managed to a degree as well.

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree

BarTender

3606 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3336529 28-Jan-2025 09:22

A managed device needs to have some Mobile Device Management or MDM tool installed on it. InTune, SCCM, Airwatch and Jamf are MDMs.

MDMs can check that patching / AV / updates are all applied and quarantine the device until it is compliant.

An AD Joined device is just that, only AD joined. There is no management over it as you can still have local admin accounts, disable Group Policy from applying etc.

xpd

Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#3336534 28-Jan-2025 09:35

Yeah, after more poking around I'm seeing conflicting info :) Some say AD is, some say its not. Think this policy will be a WIP :D

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree

Dynamic

3867 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3336541 28-Jan-2025 10:01

I agree that a managed device is a device that will show up in a portal as being compliant with policies or standards.

A computer on the local AD is simply present. Consider that computer's Windows Update feature is broken enough that it's not had security patches in months. A management platform should be able to alert you that the machine is out of an expected level of compliance.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Referral links to services I use, really like, and may be rewarded if you sign up:
PocketSmith for budgeting and personal finance management. A great Kiwi company.

BarTender

3606 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3336553 28-Jan-2025 10:34

xpd: Yeah, after more poking around I'm seeing conflicting info :) Some say AD is, some say its not. Think this policy will be a WIP :D

IMPO (In my professional opinion) a "managed device" only applies if a MDM product is actually installed. Anyone who says AD is a MDM is wrong.

tehgerbil

1102 posts

Uber Geek

ID Verified

Subscriber

#3336609 28-Jan-2025 14:33

Woah, didn't expect all the what-ifs to crop up here, but yeah xpd that's a tough one and really comes down to your personal interpretation.

Personal thoughts, for what it's worth..

Not managed:
-A personal mobile device a colleague uses for Teams/Outlook
-An iPad you can see in Apple Business Manager, but not tied to a MDM

Managed:
iPad in ABM linked to AAD/JAMF
[Any device you can query and receive more than a basic serial#/Mac#]
[Any device with a corporate VPN installed, even "BYOD" devices imo]
[Any device you can add/remove software from etc.]

But the argument could also be made any device anyone brings into your environment and interacts with your devices is managed in some way.
E.g...
A personal device connected to a BYOD wifi, you can see and manipulate their internet traffic, so that's managed.
Or if you have any personal devices connected to O365 then most (?) must enable remote wipe by default, so that's managed too?

Great question.