How to Prevent or Block Company users from Adding another Microsoft Work account in IOS Intune

prakashx86 ou're right.

The option "Block access for users trying to sign in with any other Microsoft work or school account" isn't a direct selection within Azure AD Conditional Access policies. I apologize for the confusion.

To achieve the desired outcome (blocking users from signing in with multiple work or school accounts), you would typically configure Access Controls in Conditional Access by applying certain grant controls and sign-in restrictions. However, there isn't a specific setting that directly states "block other work or school accounts."

Here’s a modified approach using the available Conditional Access features:

Updated Step 4: Control Sign-ins

1. In the Access controls section, under Grant, use the following options:

   • Choose Block access to prevent access entirely for users who don't meet your conditions.
   • Alternatively, choose Require device to be marked as compliant. This ensures that only Intune-enrolled devices that comply with your organization's policies can sign in, which indirectly prevents users from using personal or unmanaged devices with other work or school accounts.

2. Under Conditions:

   • For Device platforms, choose iOS to apply this to mobile devices.
   • For Locations, if needed, specify trusted locations to limit access based on network location (though this is optional).
   • For Client apps, you can ensure this applies only to mobile apps by specifying Browser and Mobile apps and desktop clients.

3. Grant Control:

   • Set the control to Block access for any condition that isn't met (e.g., if the device isn't compliant or enrolled in Intune).

While there's no direct policy to "block other work or school accounts" specifically, the combination of enforcing compliance and using device management ensures that only authorized and compliant devices can access corporate apps, effectively preventing users from logging in with multiple work or school accounts.

Additionally, to enforce account restrictions more strictly within specific apps (like Outlook or Teams), you can complement this with App Protection Policies in Intune, as described in Step 2. This will ensure that only the corporate account can be used within those apps, preventing users from adding secondary accounts.