Conditional Access Question

Question

We let SharePoint auto-create the policy "Block Access from Apps on Unmanaged Devices" which essentially does the following:

• Users and Groups = All Users (except Global Admins)
• Cloud apps or Actions = Office 365 SharePoint Online
• Conditions - Client Apps = Mobile apps and desktop clients
• Access Controls = Require either Hybrid Azure Joined or compliant

Someone attempted to sign into Outlook (for Android) on their tablet, and it was prompting them to install the Company Portal app. I thought it would only trigger if they were attempting to access OneDrive FB or SharePoint via an app? Turning it to Report-Only resolved for now as we're just in testing phase.

There is a separate cloud app for Exchange Online, so I thought the SharePoint app would only apply to SPO and ODfB. Any ideas?

Answer 1

Conditional Access policy is not set directly on a client (public/native) application, but is applied when a client calls a service, quoting the document here: Conditional Access: Cloud apps or actions.

The policy blocks user access whenever the client/app is calling SharePoint or OneDrive, while Outlook mobile app uses OneDrive for storage purpose. That is why Outlook mobile app is not excluded from this policy and asks for enrollment on non-compliant devices.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
**Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. **

Answer 2

Hello,

when you add your account to Outlook on Android, it automatically adds OneDrive for Business as well. And since the URL is basically on Sharepoint, then I assume this is what is happening?