Simply put, if personal device enrollment was set to blocked within Intune, someone with valid authentication information could enroll any supported Windows device they see fit into their ...