Device identification and MDCA policy application

Question

We wish to apply an MDCA policy to non corporate (BYOD) devices that will block the ability to use locally installed O365 apps and to access via browser only. We also wish to block file downloads from the O365 apps in scope to the local machine on the BYOD devices. These apps are accessed using Entra ID accounts. Access to these apps on corporate devices is to remain as is and NOT have the policy applied. What is the best method to identify corporate devices (Windows and MACs) so that we can apply the MDCA policy to those devices NOT identified as a corporate? Thanks

Answer 1

Hello @Bob Builder ,

Thank you for your question.
To achieve this, you use Intune to mark the cooperate devices are compliant the use Conditional to block non-compliant devices. Kindly look at this doc: https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad

Answer 2

Hello @Bob Builder ,

Thank you for your question. To achieve this, you can use Intune to make the corporate devices compliant then use Conditional to block non-compliant devices.  Kindly look at this doc: https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad