Display ToU when joining to Azure AD

Hi all,

We are using Azure ToU with "Require users to consent on every device" set to "off".

We would like to display a ToU when a user joins the computer to Azure AD. Is there a condition we can use in a conditional access policy?

We do have Intune enrollment as Plan B, but we would prefer to display the ToU upon joining to Azure AD.

Thanks!