Restrict some devices

rahuljindal​ 

Using Defender together with the Risk Score looks like a solid solution.
The Custom Compliance Policy you mentioned also seems useful — but do you know if it still works when combined with a Custom Extension Attribute that's based on a Conditional Access (CA) filter?

From my understanding, the device would need to be marked as compliant at the time when the attribute is created, correct?

That said, it looks like the Stuarts´s company is using an endpoint protection solution other than Defender, which might still fit into this scenario.

My question is: how would you approach this? Would you try to capture the required signals via a script (for example by checking logs or client version)? Normally, the AV solution itself should be capable of quarantining or blocking malware.

I think it would be helpful if StuartK73​ could provide us with some additional input on this.

Good luck!

Hi Buddy

Unfortunately, these devices are not yet enrolled in Defender for Endpoint, I am and have been pressing for this for a while now.

Could you elaborate on "Alternatively, if you have list of devices already identified, then you can block access to them using conditional access device filters. "

I'm struggling to get my head around the Include filtered devices in the policy  / Exclude filtered devices from the policy.

Let say we do

CA Policy - Filtered Devices

All users

All resources

Access = BLOCK

Include filtered devices in the policy

Property Operator Value

DeviceID Equals Device ID from Intune

Does that policy work out as any user accessing any cloud resource on a deviceID is blocked?

SK