Setting up and managing device configurations using Intune
Intune terms and conditions are enforced per user, not per device, and must be accepted before users can enroll devices or access protected resources in Company Portal. There is no configuration in Intune terms and conditions that:
- Automatically excludes users who already have enrolled devices, or
- Applies the policy only to “new” Company Portal sign-ins while skipping existing enrolled users.
Behavior is:
- Any user in the assignment scope who has not yet accepted that specific Intune terms and conditions policy (and version) will be prompted in Company Portal before enrollment or access.
- Once a user has accepted a given version, they are not prompted again for that version, even if they have multiple devices.
- If the terms are edited and the version is incremented with “Require users to re-accept,” all assigned users will be prompted to accept the new version once, regardless of whether they already have enrolled devices.
Because of this, assigning the T&C to “all users” will inevitably cause prompts for any assigned user who has not previously accepted that policy/version, including users who already have enrolled devices.
To minimize disruption, the only supported approaches are organizational/process-based, for example:
- Keep the existing T&C scoped to a pilot group and only expand to broader groups when ready for all those users to accept.
- If avoiding prompts for a particular population is critical, do not include those users in the assignment for that T&C policy.
There is no built-in way in Intune T&C to target “only new enrollments” or to suppress prompts for already-enrolled users once they fall into the assignment scope.
References: