Your team signs in to email and company files from laptops, phones and home computers. A trusted device is how you make sure only the right devices get in, even when a password is stolen.
What Is A Trusted Device?
A trusted device is more than just a company-owned computer or phone. It is a device that meets specific security requirements and is properly managed within your organization’s security framework. Think of it as a device that your organization can vouch for, much like how banks verify identity before issuing credit cards.
This means that your company owns, secures, controls administrative functions on, and tracks the device and its sign-ins in a central IT management platform.
Essential Elements Of A Trusted Device
Modern trusted devices include several key components:
First, they’re registered in your organization’s device management system, allowing you to track, monitor, and control security settings. This registration creates a unique identity for each device.
Second, they maintain specific security configurations, including encryption, current security updates, and approved security software. These configurations ensure consistent protection across all devices.
Finally, they operate under management policies that control how they can access and handle company data. These policies adapt based on factors like location, network connection, and user behaviour.
Why Trusted Devices Matter Now
Remote work and cloud apps mean your data no longer sits behind an office firewall. Staff can sign in to Microsoft 365 from anywhere, on any device. Multi-factor authentication checks the person. Trusted devices add a second check on the device itself: it must be known, managed and up to date before it can open company data.
How To Set Up Trusted Devices In Microsoft 365
Microsoft 365 uses two tools for this. Microsoft Entra ID (formerly Azure Active Directory) holds the identity of each user and device and decides who can sign in. Microsoft Intune manages the devices, applies security settings and reports whether each device meets your rules.
- Join company devices to Microsoft Entra ID. Windows laptops can join during first setup. With Windows Autopilot, new laptops join and configure themselves out of the box.
- Enrol devices in Intune. Windows devices enrol when they join Entra ID. Company Macs, iPhones and iPads enrol through Apple Business Manager.
- Create compliance policies. Set the rules a device must meet, such as disk encryption (BitLocker or FileVault), a minimum operating system version, a screen lock and active antivirus.
- Turn on Conditional Access. Add a policy that requires a compliant device to open Microsoft 365 apps and data. Run it in report-only mode first to see which devices would be blocked.
- Monitor and fix. Intune shows which devices fall out of compliance. Those devices lose access until the issue is fixed, for example a missed update.
Microsoft 365 Business Premium includes Intune and Microsoft Entra ID P1, which covers Conditional Access. Most small businesses do not need extra licences for the steps above. See Is Microsoft 365 Business Premium Worth It?
Can A Personal Phone Be A Trusted Device?
Usually it does not need to be. For personal phones, Intune app protection policies protect company data inside apps such as Outlook, Teams and OneDrive without managing the whole phone. You can require a PIN for work apps, block copy and paste into personal apps, and wipe only company data if the phone is lost or the employee leaves. Personal photos and apps stay private. Read more in Microsoft Intune Permissions And Privacy.
Personal computers are harder to protect. A common approach is to allow web access only, with downloads blocked, so company files stay in the cloud. For the policy side, see Staff Using Personal Devices For Work.
Integration With Zero Trust
Trusted devices are a core part of Zero Trust security. Every sign-in is checked against who the user is, what device they use and whether that device is healthy. For a full overview, see our Zero Trust Security Guide.
Frequently Asked Questions
Is a trusted device the same as a company-owned device?
Not always. A company-owned laptop is only trusted once it is enrolled in your device management system and meets your security rules. An unmanaged company laptop is not a trusted device.
What happens when a device stops being compliant?
With Conditional Access in place, the device loses access to company apps and data until the issue is fixed, for example a missed update or encryption turned off. The user sees a message that explains what to fix.
Do trusted devices replace multi-factor authentication?
No. They work together. Multi-factor authentication checks the person, and trusted devices check the device. With both in place, a stolen password alone is not enough to get in.
Setting up trusted devices with Intune and Conditional Access is part of the fully managed IT we provide, along with cybersecurity for small business. If you are looking for an IT partner who sets this up and looks after it for you, book a discovery call.
Editor’s Note: This article is part of our security best practices series. For more, see our resource guides on Zero Trust Security and BYOD & MDM.
