Conditional policies in Azure AD vs. Intune

I have not found any pitfalls to enabling modern authentication for EXO or Skype for business.

In my experience, it may take a few days before the setting will take effect for the SFB whereas there doesn't seem to be much delay for it to begin working in EXO.

One thing you may run into is your Global Admins may struggle to get remote powershell to work after enabling MFA on their accounts. To solve this, download the latest powershell modules for SFB and Exchange.

Skype Powershell Module Download

http://go.microsoft.com/fwlink/?LinkId=294688

New Exchange PowerShell Module that supports MFA

https://technet.microsoft.com/en-us/library/mt775114(v=exchg.160).aspx

The conditional access for Intune is merging into the Azure AD Premium conditional access in the Azure portal (http://portal.azure.com).

If you have a device enrolled in Intune, conditional access in Azure AD can leverage that to check compliance.

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal