Is it possible to use conditional access policy with specific logged on Windows user?

@Gregory Suvalian, Thanks for posting in Q&A. Based on my experience, it is possible to use Conditional Access policies to control access to applications based on device compliance. However, there is no method of using the currently logged on user as a signal inside Conditional Access policy evaluation.

To prevent the ability to use local accounts to log in, you mentioned you can do it via configuration policy. But you don't want it to be prevented on personal device. To avoid this, you can create a filter for corporate devices by setting (device.deviceOwnership -eq "Corporate") and apply the configuration policy only to corporate device.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters-device-properties

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hi @Gregory Suvalian ,

If I'm understanding your question correctly, it sounds like you are hoping to block access to local accounts via conditional access.

Conditional Access policies are scoped only to the built-in roles documented here: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-admin-mfa

You can create exclusions based on device compliance, hybrid join state, and device state, but you need to use Intune or group policies to enforce anything for a specific local administrator.

Let me know if this helps and if you have further questions.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.