This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 25%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ3%3C/text%3E%3C/svg%3E)
Hello team, Could you please send me steps on how I can block personal devices but allow MFA access for specific applications like Citrix. Thank you for your help
Other Configuration Manager-related features and issues
A security solution that detects identity-based threats and suspicious activities in on-premises Active Directory environments
A cloud-based identity and access management service for securing user authentication and resource access
Other Intune-related topics, including unsupported scenarios and platform-specific behaviors
A tool for managing user identities, credentials, and access across on-premises and cloud environments
Answer accepted by question author
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 69%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERJ%3C/text%3E%3C/svg%3E)
You can create a CA policy excluding Citrix workspace app and require devices to be compliant as the grant condition. Then create a 2nd CA policy for Citrix Workspace app requiring MFA as grant condition.