Conditional Access- Require Compliant Device for Office 365

This device-based conditional access policy requires users’ personal and corporate devices to be marked as compliant before accessing any Office 365 applications. Any modification to device settings after enrollment will block access to the apps. This policy requires devices to be compliant at all times. This policy discourages user from modifying their phone security settings and help protect sensitive business data.

Goal: Require devices to be marked as compliant before users can access Office 365 apps, including both personal and corporate devices after enrollment.

Important note

The Require device to be marked as compliant control:

Only supports Windows 10+, iOS, Android, and macOS devices registered with Microsoft Entra ID and enrolled with Intune.
Microsoft Edge in InPrivate mode is considered a non-compliant device. Meaning user cannot access office 365 apps from InPrivate mode

On Windows, iOS, Android, macOS, and some third-party web browsers, Microsoft Entra ID identifies the device by using a client certificate that is provisioned when the device is registered with Microsoft Entra ID. When a user first signs in through the browser, the user is prompted to select the certificate. The user must select this certificate before they can continue to use the browser.

Require Compliant Device for Office 365 Apps

This policy require compliant devices to access office 365 apps for personal and corporate iOS and Android devices. To create the policy:

Navigate to Intune portal > device > conditional access > policies > new policy.

Name: [iOS-Android-BYOD-COBO] 0365-Require-Compliant Device
Assignments:
Users:
Include: iOS_BYOD_Assigned, Android_BYOD_Assigned, iOS_COBO_Assigned, Android_COBO_Assigned
Exclude: Break glass group

Target resources:
Include: Office 365

Conditions:
Device Platforms: iOS, Android

Access control:
Grant:  Require device to be marked as compliant

What does the Office 365 target?

The following list is provided as a reference and includes a detailed list of services and applications that are included in the Conditional Access Office 365 app.