Preventing Azure Active Directory TOU from blocking Intune Company Portal sign in and enrollment

This also applies on Windows, not just mobile, and even when Terms of Use is the only Grant.

Confusingly the test device (Win Home) seemed to be successfully AD-Registered but various error messages including within the Company Portal app indicated the device was not registered. First indication that there was a problem was that enrolment was not possible.

WIP apps (e.g. OneDrive) received meaningless authentication errors also, until the Intune cloud apps were excluded, so this also complicated diagnosis.

I suggest mentioning the exclusion of Intune apps at the point of creating the Terms of Use policy, rather than the existing warning above which is not only confusing but does not align with this article. A suggestion:

"Warning: Consent on every device will prevent successful Azure AD registration and enrolment when using Terms of Use as a Grant within a Conditional Access policy, unless both Microsoft Intune and Microsoft Intune Enrolment are excluded under Cloud apps and actions."