Allow Teams desktop on unmanaged Windows, but block Outlook desktop using Entra conditional access

Hi Mark,

One thing to keep in mind is that this is a limitation of how Microsoft 365 services are architected rather than Conditional Access itself. Teams depends on Exchange Online for calendar, presence, contacts, and meeting functionality, so blocking the Office 365 Exchange Online cloud app will inevitably affect Teams.

If your goal is to allow Teams while preventing Outlook desktop access on unmanaged devices, I'd avoid blocking Exchange Online directly. Instead, use a Conditional Access policy that targets Office desktop apps and requires a compliant or Microsoft Entra hybrid joined device, while creating a separate policy for Microsoft Teams Services. If email access is still needed, allowing Outlook on the web (OWA) on unmanaged devices is often the more practical and supported approach.

I'd also be interested to know your Microsoft 365/Entra licensing (E3/E5, P1/P2), as that can influence the available Conditional Access options.

If you're targeting Exchange Online as the resource, Teams gets affected because it relies on Exchange for services like calendar, presence, and meetings. Instead of blocking Exchange entirely, create a separate Conditional Access policy that targets the Office desktop apps client and excludes Microsoft Teams Services where possible. If your goal is Outlook only restrictions, another option is to block the Outlook desktop app via app protection or client app conditions rather than blocking the Exchange resource itself.