Conditional Access Policy for non-compliant devices

Question

Conditional Access Policy for non-compliant devices

RITU RAJ 0

We need to implement a conditional access policy in our organization that allows only company-owned devices to access Microsoft Office 365 and SharePoint. Access attempts from non-compliant devices should be blocked. However, we have many vendors who use laptops from other organizations and BYOD (Bring Your Own Device) for accessing our SharePoint and Office 365 for business purposes. What would be the best solution in this case to minimize risk while still implementing the conditional access policy effectively?

Shubham Sharma 10,565 Reputation points Microsoft External Staff Moderator

2026-02-17T11:57:00.31+00:00
Hey Ritu! It looks like you’re looking to set up a Conditional Access policy that allows only company-owned, compliant devices to access Microsoft Office 365 and SharePoint, while blocking non-compliant devices—especially since you're working with vendors using their own devices. Here’s how you can approach this:

Steps to Implement Conditional Access Policy

Use Microsoft Intune for Device Management:

Enroll devices in Microsoft Intune to manage compliance settings. This will allow you to set compliance policies that devices must meet to access organizational resources.

Learn about using compliance policies in Intune.

Create a Compliance Policy:

Step into the Microsoft Intune console to create a compliance policy that outlines the requirements for devices (e.g., operating system version, security settings).

Create a compliance policy in Intune.

Set Up Conditional Access Policies:

Go to the Azure portal and navigate to Microsoft Entra ID, then Security > Conditional Access.

Create a new policy that requires devices accessing Office 365 and SharePoint to be compliant.

Grant Controls: Use the option "Require devices to be marked as compliant” as part of your access controls.

How to require compliant devices in Conditional Access.

Consider BYOD Policies:

For vendors using their devices, you can set up a separate Conditional Access policy that restricts access to certain resources or requires specific applications (like the use of Microsoft Authenticator).

Implement app protection policies for BYOD scenarios.

Testing and Monitoring:

Before enforcing your policies, use report-only mode to evaluate their impact and gather insights on how they might affect users.

Monitor compliance statuses through the Intune dashboard and refine your policies as needed.

Additional Recommendations

Educate Users: Make sure users (including vendors) are aware of the compliance requirements and provide guidance on how to enroll their devices.

Utilize Device Filters: For more granularity, use device filters in Conditional Access policies to include or exclude certain device types or app usage scenarios.

Emergency Access Accounts: Always maintain an emergency account that can bypass conditional access, just in case!

Resources

Require compliant devices in Conditional Access

Creating a compliance policy in Intune

Use compliance policies to set rules for devices you manage with Intune

Hope this helps! Let me know if you have any other questions!
RITU RAJ 0 Reputation points

2026-02-17T13:18:04.24+00:00

Thank you, Shubham, for the information. We have implemented a conditional access policy that allows only company-owned, compliant devices to access Microsoft Office 365 and SharePoint while blocking non-compliant devices. However, we have received a lot of feedback, and we have to roll back the change for now, as our organization is not in a position to implement strict measures at this time. We need vendors to be able to use BYOD (Bring Your Own Device) or devices from different companies. Given this situation, what would be the best solution?
Shubham Sharma 10,565 Reputation points Microsoft External Staff Moderator

2026-02-20T12:54:39.03+00:00
RITU RAJ

Thank you for your reply.

Below are the resolution steps:-

. Allow BYOD and vendor devices, but enforce limited access

Instead of requiring company‑owned, compliant devices, configure Conditional Access to:

Allow unmanaged/BYOD devices

Restrict what those devices can do

This is done using Session controls → Application‑enforced restrictions in Conditional Access.

What users get on unmanaged devices

Browser‑only access to SharePoint, OneDrive, Exchange

No download

No print

No sync

View (and optionally edit) in browser

This is explicitly supported for SharePoint and OneDrive and is designed for BYOD scenarios.

Use Conditional Access with “Application‑enforced restrictions”

Create a Conditional Access policy:

Users: Vendors / external users / broad user group

Cloud apps: Office 365 (or SharePoint Online + Exchange Online)

Grant: Allow access

Session: Use application‑enforced restrictions

This tells Microsoft 365 apps to automatically downgrade access when the device is unmanaged.

Control unmanaged device behavior in SharePoint

In the SharePoint admin center:

Set Unmanaged devices to:

Allow limited, web‑only access

(Optional) Disable editing if risk tolerance is low

This configuration is natively integrated with Conditional Access and does not require Intune enrollment.

Optional (recommended): Add MFA instead of device compliance

If strict device enforcement is not possible yet:

Require MFA for:

BYOD users

Vendors

External identities

This aligns with Microsoft’s Zero Trust guidance and significantly reduces risk without blocking access.

Future‑ready option (when maturity improves)

When the organization is ready later:

Introduce Intune App Protection (MAM) policies

Protects data inside Outlook, Teams, OneDrive

Does not enroll or manage the full device

Common for contractors and partners.

What to avoid (given your situation)

Blocking unmanaged devices entirely → high business friction

Forcing device compliance for vendors → operationally unrealistic

Full Intune enrollment for personal devices → low adoption

For your reference:-

https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session

https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices

1 answer

Your answer

RITU RAJ 0 Reputation points

2026-02-17T13:18:04.24+00:00

Thank you, Shubham, for the information. We have implemented a conditional access policy that allows only company-owned, compliant devices to access Microsoft Office 365 and SharePoint while blocking non-compliant devices. However, we have received a lot of feedback, and we have to roll back the change for now, as our organization is not in a position to implement strict measures at this time. We need vendors to be able to use BYOD (Bring Your Own Device) or devices from different companies. Given this situation, what would be the best solution?

Answer 1

Hello RITU RAJ,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are in need to implement Conditional Access Policy for non-compliant devices.

To avoid any misconceptions, issues and still meet the customer need by block high-risk non-compliant devices, but still enable BYOD access safely you will need to use a hybrid conditional access strategy:

Recommended Conditional Access + App Protection Strategy if it's a corporate devices:

Require device compliance with MDM (Intune)
- Create a compliance policy in Intune (OS version, encryption, etc.).
- Create a CA policy that requires device compliance for corporate devices.
- Allow access only if device is marked compliant. ([Azure Documentation][8])
For BYOD Vendor and/or Personal Devices:
Use App Protection Policies (MAM) without MDM enrollment
- Create Intune App Protection Policies targeting BYOD users.
- These policies secure corporate data per app only (e.g., Outlook, Teams).
- Data leakage prevention & controls are enforced even on personal devices. ([Microsoft Learn][2])
Conditional Access for BYOD devices
- Create CA policy targeting BYOD group or device filters (deviceOwnership eq Personal).
- Grant controls: Require app protection policy OR require compliant device.
- Configure Require approved client app (e.g., Outlook, Teams).
- For multiple controls choose Require one of the selected controls. ([Microsoft Learn][2])
For Browser Restriction Option: Optionally, limit BYOD access to browser only, restrict file downloads via session & cloud app controls. ([TMinus 365][3])

Therefore, to simplify. The policy deployment approach will be similar to the below:

In a scenario of Corporate Managed Devices, the Conditional Access Requirement will be to require compliant device (MDM).
In a scenario of BYOD (Personal/non-enrolled), the Conditional Access Requirement will be to Require App Protection Policy OR Approved Client.
In a scenario of High-risk access, the Conditional Access Requirement will be to add additional MFA or Defender for Endpoint signals.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Conditional Access Policy for non-compliant devices

Steps to Implement Conditional Access Policy

Additional Recommendations

Resources

1 answer

Your answer