Is Intune mandatory for device restrictions?

Question

Is Intune mandatory for device restrictions?

jhb 61

I constructed an SSO login to Atlassian products in Azure.
And device restrictions were added to conditional access.
Can't I use device restrictions if I only use the ADP1 license without Intune?
Is Intune license mandatory for device registration with Azure?

Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-16T03:22:16.63+00:00

@jhb , Hope things are going well! Was the following information helpful? If there's still anything else we can help, feel free to post back.
jhb 61 Reputation points

2022-02-16T06:43:44.907+00:00

Please check the comments.

Accepted answer

0 additional answers

Your answer

Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-16T03:22:16.63+00:00

@jhb , Hope things are going well! Was the following information helpful? If there's still anything else we can help, feel free to post back.
jhb 61 Reputation points

2022-02-16T06:43:44.907+00:00

Please check the comments.

Answer 1

VipulSparsh-MSFT 16,311 Microsoft Employee

@jhb You can have the Device registration with Azure AD without having Intune license. Intune license is only required when you need to use the Compliant device parameter in conditional access (compliance parameter is set by Intune Service).

Now under the New feature in Conditional access for Filter for devices you have many attributes on which you can decide a Device conditions. For example Trust Type :

None of above would need an Intune license. You can certainly explore more : https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

jhb 61 Reputation points

2022-02-16T06:13:12.437+00:00

Hi.
What should I add conditions to the filter and allow to Grant?
jhb 61 Reputation points

2022-02-16T06:42:54.88+00:00

@VipulSparsh-MSFT @Crystal-MSFT

I am using SSO for Atlassian Cloud products.
Conditional access was defined as follows.
However, it is not blocked when accessing from unregistered devices.
Please tell me how to block access from unregistered devices.

Please tell me how to register the device in Azure AD without Intune.
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-16T06:55:46.587+00:00

@jhb , Based on my understanding, under Filter devices, I think we can configure as below to test.
Include filtered devices in policy
trustType not equals Azure AD registered and Azure AD joined
jhb 61 Reputation points

2022-02-16T07:00:52.403+00:00

@Crystal-MSFT
Oh, you were right.
Thank you for your answer.
But I don't know how to register the device in Azure AD without Intune.
I don't use MDM separately.
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-16T07:15:34.25+00:00

@jhb , To register device to Azure AD, here is a link with the steps for the reference:
https://support.microsoft.com/en-us/account-billing/register-your-personal-device-on-your-work-or-school-network-8803dd61-a613-45e3-ae6c-bd1ab25bf8a8
jhb 61 Reputation points

2022-02-16T12:03:13.51+00:00

@Crystal-MSFT
I registered the device and the Join Type is Azure AD registered.
I set the restriction setting like a capture screen.
However, it is blocked upon access from registered devices. Do you know why?
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-17T01:46:53.927+00:00

@jhb ,After checking the official article, I find the value for Azure AD joined and registered are different under filter. For Azure AD joined device, the value is AzureAD. For Azure AD registered device, the value is Workplace. We can change the values to see if it works.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices
jhb 61 Reputation points

2022-02-17T02:37:59.007+00:00

@Crystal-MSFT
Thank you for your answer.

I followed Policy 2 of the link you uploaded, but access is still blocked from the registered device.

Please teach me the way.
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-17T06:52:12.497+00:00

@jhb , Thanks for the reply. We can try to set as below:
Exclude filtered deices from policy
trustType equals AzureAD
trustType equals Workplace
jhb 61 Reputation points

2022-02-17T07:45:59.193+00:00

@Crystal-MSFT

Thank you for your answer.

The value values that can be selected are registered, joined, and hybrid joined.

Access is still blocked from registered devices.
Changing And/Or to And is also blocked.

My device is registered.
Why isn't it working? :'-(
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-17T08:11:29.567+00:00

@jhb , Thanks for the reply. if it is still not working, I suggest to open case to check the detailed logs to see if there's any more finding. Here is the link about opening case for the reference:
https://learn.microsoft.com/en-us/answers/questions/730069/is-intune-mandatory-for-device-restrictions.html?childToView=739408#comment-739408

Thanks for the understanding.
jhb 61 Reputation points

2022-02-17T09:20:34.927+00:00

@Crystal-MSFT

Capture is a screen displayed when access is blocked.
The device status is Unregistered. Is that why it's not working?
When checked in Azure, it is registered.
Please tell me how to recognize it as registered in my browser.
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-18T02:14:19.147+00:00

@jhb , From the dsregcmd result, I notice Workplace Joined displayed in the "User state" section shows Yes. It means the device is Azure AD registered. But it is rejected by conditional access. I suggest to open case which is free to check on the background to find the issue.

Thanks for the understanding.
jhb 61 Reputation points

2022-02-18T06:19:50.167+00:00

@Crystal-MSFT
My PC account was a local account, so it was not working.
When I accessed the PC through the Azure account, it worked normally.
Thank you for your answer so far.
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2022-02-18T08:29:04.19+00:00

@jhb , Thanks for the update. I am glad to hear that it is working. Congratulations! Again thanks for sharing the solution. It can help others who has the same issue. I appreciate it.

Thanks for your time and have a nice day!

Share via

Is Intune mandatory for device restrictions?

0 additional answers

Your answer