Conditional Access Policy Limiting Access to i365 SharePoint to only devices which are joined Azure

Question

Configured Conditional Access policy to limit access to SharePoint from only Jointed /Corporate devices to disallow registered devices:

Details of the policy are below

Applicable: All users

Resource Included: Office 365 SharePoint Online

Condition: Filtered devices based on Properties: Corporate and Microsoft Entra JoinedI tried both options for Grant:

ALLOW when Filtered devices are INCLUDED

BLOCK when filtered devices are EXCLUDED

Registered Personal devices still have access to SharePoint online.

Any thoughts?

Answer 1

To limit access to SharePoint Online only from corporate devices joined to Azure, you need to ensure that your Conditional Access policy is correctly configured to filter out personal devices. Here are some steps and considerations:

1. Policy Configuration: Ensure that your Conditional Access policy includes the correct conditions to filter devices. You should set the policy to block access for devices that do not meet the criteria of being corporate or Microsoft Entra joined.
2. Device Filter: When configuring the device filter, ensure that you are using the appropriate properties to identify corporate devices. For instance, you might want to use properties like device.extensionAttribute1 or similar attributes that distinguish corporate devices from personal ones.
3. Grant Controls: When setting the grant controls, if you want to allow access only for corporate devices, you should select the option to Block access for filtered devices that do not meet your criteria. Conversely, if you allow access when filtered devices are included, ensure that the filter accurately identifies only the intended corporate devices.
4. Testing and Validation: After configuring the policy, test it with various device types to ensure that personal devices are being blocked as expected. If registered personal devices still have access, double-check the filter conditions and the inclusion/exclusion settings.
5. Review Logs: Utilize sign-in logs in Azure AD to review the access attempts and see why personal devices are still gaining access. This can provide insights into whether the policy is being applied correctly.

If you've followed these steps and personal devices still have access, consider revisiting the policy settings or consulting Microsoft documentation for further troubleshooting guidance.

---

References:

• Conditional Access: Filter for devices
• IT Admins - SharePoint and OneDrive unmanaged device access controls

Answer 2

Including registered devices and setting grant to block worked