Restricting Access to a Web Application Based on Device Compliance with Intune and Azure AD

Question

I am currently using Microsoft Intune to manage access to a third-party web application that has been registered as a web link app type. I have successfully added the application in Intune, and it appears in the Company Portal. However, users can share the link to the web application with others who do not have the Company Portal app installed, which allows access from non-compliant devices that I want to prevent.

Requirements:

• Restrict access to the web application so that it can only be opened on devices compliant with our Intune policies.
• Block users from opening the application on non-compliant devices, even if they have the link.

Steps Taken:

1. Conditional Access Policies: Created a Conditional Access policy in Azure AD that requires devices to be compliant to access the application.
2. Compliance Policies: Set up compliance policies in Intune to define the compliance criteria for devices.

Questions:

1. What additional configurations or steps should be implemented to ensure that only compliant devices can access the web application and prevent link sharing?
2. Are there specific Intune App Protection Policies that should be applied to further restrict access based on device compliance?

Any guidance or best practices on how to effectively enforce these restrictions would be greatly appreciated!