Confirmation Required: Conditional Access, Device Compliance and Company Portal App Downloads

Question

Hi Microsoft Support Team,

I hope you are doing well.

Could you please confirm whether, in an environment where Microsoft Entra Conditional Access requires a device to be marked as compliant, a device that Intune reports as Non-compliant due to BitLocker/encryption method requirements and Firewall configuration can be prevented from accessing the services required to download corporate applications through Company Portal?

More specifically, I would like to confirm the following scenario:

Device encryption / Firewall configuration not compliant - Intune reports the device as Non-compliant - Conditional Access evaluates the device as not compliant - Conditional Access blocks access to protected corporate resources/services -- The user is therefore unable to download corporate applications through Company Portal.

I understand that Intune can still manage and deploy applications to a device even when it is Non-compliant. However, my question is specifically whether Conditional Access can prevent the authentication/access required by Company Portal to download applications when the device does not satisfy the compliance requirement.

Could you please confirm whether this is the expected behavior and, if possible, provide the relevant Microsoft documentation supporting this scenario?

This clarification is important because there appears to be some uncertainty internally about whether the inability to download corporate applications is related to the device's Non-compliant status and the Conditional Access policy.

Thank you for your assistance.

Best regards,

Daniel

Answer 1

Yes. That behavior is expected when access to the required service is protected by a Conditional Access policy that uses Require device to be marked as compliant.

Supported flow:

1. A device enrolls in Intune and registers in Microsoft Entra ID.
2. Intune reports the device compliance state to Microsoft Entra ID.
3. If the device is Non-compliant because it fails compliance settings such as encryption or firewall requirements, Conditional Access evaluates it as not compliant.
4. When a Conditional Access policy requires the device to be marked as compliant, access to protected organizational resources is blocked.

Microsoft documentation states that when Conditional Access uses device compliance status, Conditional Access uses that compliance status to determine whether to grant or block access to organizational resources. It also states that when a device is not compliant and a Conditional Access policy applies, the device is blocked.

For the Company Portal part of the scenario, the documented exception is narrower than a general app download allowance:

• Require device to be marked as compliant does not block Intune enrollment.
• It also does not block access to the Microsoft Intune Web Company Portal application.

So the correct interpretation is:

• A noncompliant device can still be allowed through the specific exceptions for enrollment and the Microsoft Intune Web Company Portal application.
• But if downloading or installing a corporate app through Company Portal requires access to other protected corporate resources or services that are covered by Conditional Access, those accesses can be blocked because the device is noncompliant.

This means the statement "noncompliant device = always unable to download apps from Company Portal" is too broad based on the available documentation. The supported conclusion is:

• Conditional Access can block access required by Company Portal app scenarios when that access depends on protected resources and the device is noncompliant.
• Conditional Access does not block Intune enrollment or access to the Microsoft Intune Web Company Portal application solely because the policy requires device compliance.

If the internal question is whether noncompliance from encryption/firewall settings can be the reason users cannot access protected services needed during app acquisition, the answer is yes.

---

• Use compliance policies to set rules for devices you manage with Intune
• Troubleshoot Conditional Access
• Require a compliant device, Microsoft Entra hybrid joined device, or multifactor authentication for all users