Allow Teams desktop on unmanaged Windows, but block Outlook desktop using Entra conditional access

Hi Mark,

One thing to keep in mind is that this is a limitation of how Microsoft 365 services are architected rather than Conditional Access itself. Teams depends on Exchange Online for calendar, presence, contacts, and meeting functionality, so blocking the Office 365 Exchange Online cloud app will inevitably affect Teams.

If your goal is to allow Teams while preventing Outlook desktop access on unmanaged devices, I'd avoid blocking Exchange Online directly. Instead, use a Conditional Access policy that targets Office desktop apps and requires a compliant or Microsoft Entra hybrid joined device, while creating a separate policy for Microsoft Teams Services. If email access is still needed, allowing Outlook on the web (OWA) on unmanaged devices is often the more practical and supported approach.

I'd also be interested to know your Microsoft 365/Entra licensing (E3/E5, P1/P2), as that can influence the available Conditional Access options.