Intune - Policies

Question

Hi All,

I need some advice on how to acheive below

• I created a conditional access policy to block windows & mac devices. So i created condition under "filter by devices" as include Azure AD joined devices as equal with allow access. it allowed both personal and Azure AD joined. but we need to block personal devices

so i tried condition under "filter by devices" as include Azure AD joined devices as not equal with block access. it blocked personal and azure ad joined devices. Please suggest how to allow azure AD join devices and block personal devices

• Is there a way to block the network share on windows 10 using Intune policy
• I created password complexity device restriction policy - i have set as "Password complexity
  Numbers, lowercase, uppercase and special characters required" but it failed. Is it not supported on Windows 10 desktop/laptop
• We have set password threshold as 5, i tested attempting the wrong password after 5 which worked fine. But in admin.microsoft.com - under active user - user name - the unblock option is not enabled (it shows only block - normally it should show unlock or unblock right)

Please provide your suggestions

Answer 1

@karthik palani , For your questions, here are my suggestions:

1. To block personal device in conditional policy, we can set "deviceOwnership" Equals Personal to block.
   
2. To block network share, based on my research, there's no built policy Intune to do this. But I find maybe we can use Powershell to disable file and printer sharing to accomplish this. Here is a link for the reference:
   https://www.c-sharpcorner.com/article/how-to-enable-or-disable-file-and-printer-sharing-in-windows-102/
   Note: Non-Microsoft link, just for the reference.

We can test the command on device manually to see if it can work. If yes, then we can deploy Powershell Script via Intune to do it in a batch.

3. For the password complexity policy, the support value is as below. Please check if our situation is met.
   
   https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-devicelock?WT.mc_id=Portal-fx#devicelock-mindevicepasswordcomplexcharacters

For the password threshold, to know it better, could you let us know where we configure the setting?

Please check the above information, if there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi Crystal,

Appreciate your support as usual

The password threshold set under Azure Active directory - Security - Authentication - Password protection - "Lockout threshold"

Answer 3

The setting that you were referring above was Azure AD Smart lockout which must work for the devices that are Azure AD join when device has internet connection however if device is offline then Azure AD Smart lockout policy won't take effect and user may continue to login Windows Sign-in using cache. Hope this helps.

Note: while testing make sure you try with three different password each attempt because Azure AD smart lockout is not traditional AD lockout so to get attempt marked as 3 bad passwords, you need to try three different password each attempt. if you repeat same password multiple times. it won't increase the count.