Intune Unmanged devices = Block access to all cloud apps

Question

Intune Unmanged devices = Block access to all cloud apps

Rohanathan S 21

Hi Team,

Is there a way to block access to devices that are not managed by Intune?

In conditional access there is an option to Grant "Require Hybrid Azure AD joined device".

However, we are joining devices by Azure AD join. Is there a way to block access when that device is not enrolled with Intune?

Answer 1

Lu Dai-MSFT 22,796 Microsoft Vendor

@Rohanathan S Thanks for posting in our Q&A.

If you want to block unmanged devices to access to cloud apps, it is suggested to select "Require device to be marked as compliant" in conditional access policy.
https://learn.microsoft.com/en-gb/azure/active-directory/conditional-access/concept-conditional-access-grant#require-device-to-be-marked-as-compliant

When the device is enrolled to intune and the device shows compliant, the device can access to cloud apps. When the device is not enrolled to intune or the devices is not compliant, the device can't access to cloud apps.

Hope it will help.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Rohanathan S 21 Reputation points

2022-02-15T11:47:54.083+00:00

Hi @Lu Dai-MSFT thank you very much for your answer, I tried the same and it was successful.

However, instead of "You can't there from here" message, I received "To access your service, app, or website, you may need to sign in to Microsoft Edge using xxxx@yyyy."

And with Chrome I was asked to download the "Windows 10 Accounts" Extension with the same error.

Hope this is the expected way of the CA policy in working.

Regards,
Rohan
Lu Dai-MSFT 22,796 Reputation points Microsoft Vendor

2022-02-16T07:15:40.68+00:00

@Rohanathan S Thanks for your update.

I have done the test in my lab. I add my user account "test1@m365xxx.com" in the setting "Users or workload identities" in the conditional access policy. When I use the account to sign in the cloud app(Outlook) via Edge in an unenrolled device, it shows the following message.

Intune Unmanged devices = Block access to all cloud apps

0 additional answers

Activity