The Laptop Nobody Enrolled: Unmanaged Devices and Company Data

The device most likely to let ransomware into your business is not your best-protected PC. It is the laptop nobody enrolled: no managed antivirus, no one watching its alerts, and still signed in to company email and files. The fix is to find every device that touches company data, bring it under management, and let only managed, compliant devices in.

The short answer

Most businesses can say how many Microsoft 365 licences they pay for. Far fewer can say how many devices are signed in with those accounts. The gap between the two numbers is where the risk sits.

An unmanaged laptop is not necessarily old or broken. It is simply outside the system: nobody pushed security settings to it, nobody checks whether it is up to date, and if its antivirus raises an alarm, nobody hears it. Attackers do not need to beat your strongest controls. They need one device that sits outside them.

How the unmanaged laptop happens

Nobody decides to leave a device unmanaged. It happens in the ordinary course of running a business:

The rushed purchase. A new hire starts on Monday, a laptop is bought on Saturday, and it is set up from the box with a personal sign-in. It works, so nobody comes back to it.
The owner's own machine. The founder's personal laptop has opened the shared drive since day one. It is the most privileged device in the company and the least managed.
The hand-me-down. A laptop moves from a departing staff member to a new one without being wiped or re-enrolled.
The home PC. Someone checks email from the family computer once during a busy week, and the browser stays signed in.
The contractor. A freelancer is given an account for a project and works from their own device for months.

Each one is reasonable on the day. Together they add up to a list of devices that can reach company data but that no one is responsible for.

Why attackers go for the one nobody watches

Most incidents start with something small: a phishing email, a fake invoice, a malicious download. On a managed device, several layers have a chance to stop that small thing becoming a big one. Security settings limit what can run, updates close known holes, and endpoint protection flags suspicious behaviour to someone who acts on it.

On an unmanaged device, those layers are missing or unmonitored. And because the device is signed in to Microsoft 365, it is not isolated. Files synced to OneDrive or SharePoint from that laptop are company files. If ransomware encrypts them locally, the encrypted versions can sync back to the cloud.

Microsoft does give you a way back. With a work or school account, OneDrive can be restored to an earlier point within the last 30 days, which covers files that were deleted, overwritten or infected by malware. That is a recovery tool, not a prevention tool, and 30 days is not long if nobody notices for a few weeks. It is also no help with whatever was taken before the files were encrypted.

What "managed" actually means

A managed device is one your organisation can see, configure and check. In practice that means four things:

Enrolled. The device is registered in your management system, such as Microsoft Intune, so it appears in an inventory with an owner.
Configured. Security settings such as disk encryption, a screen lock and a supported operating system version are pushed to it, not left to the user.
Protected and watched. Business endpoint protection is installed and reports to a console that someone actually reviews.
Checked. A compliance policy confirms the device still meets your rules, and the result is used to decide whether it may reach company data.

The last point is what turns management from a good intention into a control. A device that falls out of line should lose access until it is fixed.

Closing the door: only compliant devices get in

In Microsoft 365, the mechanism for this is Conditional Access. A policy can require a device to be marked as compliant before it signs in to email, Teams, OneDrive or SharePoint. Intune checks each enrolled device against your compliance policy and reports the result to Microsoft Entra ID, and Conditional Access uses that result to grant or block access.

Three details decide whether this works in practice:

Licensing. Conditional Access needs Microsoft Entra ID P1. It is included in Microsoft 365 Business Premium, which also includes Intune, so many small businesses already own what they need without realising it.
The default you need to change. Intune has a tenant-wide setting for devices that have no compliance policy assigned. By default those devices count as compliant. Microsoft recommends switching it to not compliant if you use device compliance with Conditional Access, so that only devices confirmed as compliant get through.
Roll it out carefully. Microsoft's guidance is to create the policy in report-only mode first, review who would have been blocked, and only then switch it on. Emergency access accounts should be excluded so a misconfiguration cannot lock every administrator out.

Report-only mode is often where businesses discover their unmanaged laptops. It shows which sign-ins come from devices that would fail the check, before anyone is blocked.

Not every device needs to be fully enrolled. A personal phone used for email is a different case from a laptop that syncs the finance folder. The useful question is not whether a device is company-owned or personal, but what it can reach and what happens to that data if it is lost or infected. For devices you cannot or should not fully manage, the answer is usually a narrower kind of access rather than none at all, such as working through protected apps instead of syncing files locally. For any device that holds or syncs company files, management is the safer default.

Frequently asked questions

How do I find out which devices are signing in to Microsoft 365?

Microsoft Entra ID sign-in logs record details of the device and application used for each sign-in, and enrolled devices appear in the Intune device list. Comparing the two shows you which devices are signing in without being managed. Running a Conditional Access policy in report-only mode makes this easier, because it shows which sign-ins would fail a device check.

Do we need Microsoft 365 Business Premium to require compliant devices?

You need Microsoft Entra ID P1 for Conditional Access and Intune for compliance policies. Business Premium includes both, which is why it is the usual starting point for small businesses. Other plans can work with add-on licences.

Will requiring compliant devices lock staff out?

It can if it is switched on without preparation. That is why the policy should run in report-only mode first, with emergency access accounts excluded, so you can enrol the devices that need it before anyone is blocked.

Is antivirus on every laptop enough?

It is one layer, not the whole answer. Without management, nobody knows whether the protection is running, whether the device is up to date, or whether it has raised an alert. The product matters, but so does knowing the device exists and seeing what it reports. We covered the difference between detection and prevention in an earlier article.

What about the owner's personal laptop?

It is often the most important device to bring under management, because it usually has the widest access. If it cannot be enrolled, limit what it can reach rather than leaving it as the exception nobody mentions.

Where to start

Start with the list. It is common to find at least one device nobody knew was still signing in, and that discovery alone changes the conversation. From there, the gap closes in six steps:

List every device that touches company data. Start from Microsoft Entra ID sign-in activity rather than the asset register, because the asset register only lists what you bought.
Give each device an owner and a status. Managed, unmanaged, or unknown. Unknown is the one to chase first.
Enrol what should be managed. Bring company laptops and desktops into Intune and apply a baseline: encryption, screen lock, updates.
Put business endpoint protection on every enrolled device. Make sure alerts go to someone with time to act on them.
Turn on compliance-based access in report-only mode. Review the results for a couple of weeks before enforcing.
Enforce, then review regularly. New staff, new contractors and replacement laptops will keep arriving. Check the device list on a schedule, not only after an incident.

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. We help Philippine businesses find every device that touches company data, bring it under management, set up compliance-based access in Microsoft 365, and roll out next-generation antivirus on every endpoint, billed in pesos with official receipts.

See our Cybersecurity Services, or book an endpoint security assessment.