Condtional Access Policy - Filter for Devices

Question

Hi All

Has anyone been able to create a Conditional Access using Filter for Devices to block older Windows Operating systems like Windows 7 or 8?

Answer 1

Hi @HiteshP ,

Yes, you can create a filter to block older operating systems. The generally recommended way to do this is to create a Filter for devices in a Conditional Access policy, apply it to All users, accessing all cloud apps.

Then you would add an "exclude" filter for devices using rule expression operatingSystem equals Windows and operatingSystemVersion startsWith "10.0", like this sample one that I added :

For additional context, this scenario is documented in the Filter for devices guide.

I hope this helps.

-

If the information helped you, please Accept the answer. This will help us and other community members as well.

Answer 2

Unfortunately the "Starts With" operator only captures devices which are registered in Azure.
We want to block all older Windows devices, even personal devices.

We tried exclude devices Notstartswith 10.0 and it sort of works, except it also blocks Windows 10 devices which are not registered in Azure.

"For a device that is unregistered with Azure AD, all device properties are considered as null values and the device attributes cannot be determined since the device does not exist in the directory. The best way to target policies for unregistered devices is by using the negative operator since the configured filter rule would apply. If you were to use a positive operator, the filter rule would only apply when a device exists in the directory and the configured rule matches the attribute on the device."

Answer 3

Hi @HiteshP ,

Apologies for the delay! In that case you should be able to set it to exclude the device if Operating System = Windows 8 or Operating System = Windows 7.

I am able to set this in my lab and others have confirmed that it worked for them. Let me know if you face issues with it though.

-

If the information helped you, please accept the answer. This will help us and other community members as well.