This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 19%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Hi, I'm hoping to get some tips on Conditional access.
We would like to allow only "compliant devices" (Intune) to be able to access "Office 365 Sharepoint Online". This can simply be done by going in the sharepoint admin center and switch "unmanaged devices" to "Allow limited, web-only access".
Due to the fact that we have a RDS environment I've excluded a IP from that policy. That works fine.
We would like our users to be able to use Microsoft Flow (Power Automate) for sharepoint.
I'm not sure how/if we are able to exclude Power Automate from the conditional access policy. Can this be done?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
From your description, we find the issue is more related to Azure AD Conditional Access policy, I would remove the tag of "mem-intune-conditional-access".Thanks!
is this something that can help you? https://janbakker.tech/use-power-automate-as-your-ca-police-department/
Regards,
Eswar
www.eskonr.com
If the response is helpful, please click "Accept Answer" and upvote it.
Thank you for that link. It doesn not apply though. The link automates exclusions for conditional access using Microsoft Flow.
I would need a way to exclude microsoft flow from a conditional access policy.
Just found that I only needed to select require approved client app under the access control.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 31%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAH%3C/text%3E%3C/svg%3E)
Thanks for the tip : I have this issue too.
Could you just add some clarifications ?
In Sharepoint Admin Center --> Policies --> Access Control, I have set "Allow limited, web-only access" for "Unmanaged devices". This setting creates 2 conditional access policies :
If I add "require approved client app" in the "Grant" settings of the first policy, it means that if someone with an unmanaged device tries to connect with SharePoint app from a mobile phone, the access will be granted... Or we want to allow only Compliant or Hybrid Entra Joined devices.
So I guess i need to enable this setting in the grant Section on the second policy which applies to browser connection.
Anyway, enabling this setting in the Grant Section will be deprecated according to this article : https://learn.microsoft.com/en-us/entra/identity/conditional-access/migrate-approved-client-app
Thanks for your help.