Conditional Access Reporting for Intune Enrolled Windows Devices

Hi Stuart — your filter itself looks right. That exact expression, device.deviceOwnership -eq "Company" with Include, is the one Microsoft documents for company-owned devices, so I wouldn't change the syntax.

The part that usually trips people up is what that filter actually checks. It only says something about ownership, not about enrolment or compliance. A company-owned device can still be in your directory without being Intune enrolled, or enrolled and not compliant yet, and it will still match the filter — and then fail the compliant-device requirement. So a failure on a device you think of as unmanaged may still be a company device, just not a compliant one.

There's a second piece worth knowing. Microsoft's device filter documentation says the filter is evaluated from device authentication, and for a device that isn't registered in Entra ID at all, its device properties are all null, so a positive equals filter like yours doesn't match it. In other words, a genuinely unregistered device shouldn't be in scope for this policy at all.

So when you look at those failures in Insights and Reporting, I'd drill into one of them rather than trusting the headline count. Check the sign-in detail for that policy result — whether it shows as Report-only: Failure for this policy, or Not applied — and look at the device detail for that sign-in: is there a device ID, and is the device actually registered, and what does its ownership say. The workbook breaks results down per policy and per condition, and by default it selects all enabled policies too, so make sure only this report-only policy is selected when you're reading it.

If the failures that worry you turn out to be registered company devices that just aren't compliant yet, the filter is doing its job and those are exactly the users you'd want to see before you switch the policy on.