Conditional policies in Azure AD vs. Intune

Robert,

Since you mentioned you have users on Office 2013, you will need to roll out two registry keys as described here:

https://support.office.com/en-us/article/Enable-Modern-Authentication-for-Office-2013-on-Windows-devices-7dc1c01a-090f-4971-9677-f1b192d6c910?ui=en-US&rs=en-US&ad=US

This is not required for Office 2016, as it supports modern authentication by default.

Note: If you do not roll out these registry keys, but you run the two powershell commands in your tenant for Exchange and Skype to support MFA, it does no harm.  Just keep in mind the following sequence:

- enable Modern Auth (MFA) at the tenant level by running the two powershell commands (one for Skype and one for Exchange

- Roll out registry keys for Office 2013

- Enable users for MFA

So as you can see, until you enable a user for MFA, there is no impact to the users. Prior to enabling a user for MFA, just be sure to deploy the reg keys to them.

Making decisions like this is always challenging because the requirements keep changing.

Have you seen this announcement? you can try to keep up with the changes at https://docs.microsoft.com/en-us/intune/whats-new.  

Week of June 5, 2017 Microsoft Intune and Conditional Access admin consoles are generally available

We’re announcing the general availability of both the new Intune on Azure admin console and the Conditional Access admin console. Through Intune on Azure, you can now manage all Intune MAM and MDM capabilities in one consolidated admin experience, and leverage Azure AD grouping and targeting. Conditional access in Azure brings rich capabilities across Azure AD and Intune together in one unified console. And from an administrative experience, moving to the Azure platform allows you to use modern browsers

Make sure to update Azure AD Connect, there was a Security Advisory last week https://technet.microsoft.com/en-us/library/security/4033453.aspx?f=255&MSPPError=-2147217396