defender & intune-restrict access to a website based on device risk level

Question

Hi all,

is it possible to restrict access to a public website based on a risk level calculated by defender? Lets say that if a device has HIGH risk level, it will not be allowed to access particular web site....

PS: We use M365 E3 with M365 E5 Security addon.

Thank you.

Answer 1

@michal, Thanks for posting in Q&A.

For the web site, if it is related with the cloud app in Conditional access, maybe we can create conditional access policy to block the access according to the risk score.

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#microsoft-cloud-applications

We can create a compliance policy and mark the device at or under the machine score as non-compliant:

https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows#microsoft-defender-for-endpoint-rulesdevice

Then you can create conditional access policy to require a compliant device to block the non-compliant device access to the cloud resource:

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device

However, if the above information can not help, you can contact Microsoft Defender for Endpoint support in the following link to see if it can be done there:

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Just an idea - if you limit access to local M365 apps, users will do anything to fix it :)