Limit user login only from domain joined or compliant pc

[Don_Vlogeer]

Dear All, 

is there anyway we to limit user access mailbox only from domain joined pc, not allowed to login via personal or public pc. 

for owa we can certainly use ADFS to setup rules, is there any possibility on outlook client either using hma, adfs, or conditional access. 

Our environment is exchange 2019 hybrid 

[#2]

Conditional access should help: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access...

[#3]

@Vasil Michev 

May I know in CA under target resources, there is no exchange server, if exchange online covering on premise mailboxes as well ? 

thank you. 

[#4]

The condition you've selected applies only to cloud app (those that integrate with Azure AD). To get CA policies to work with Exchange Server, you should implement HMA: https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use#intun...

[#5]

@Vasil Michev 

Thank your for quick respond. Our environment HMA already in position by following this kb, but still no luck using CA. 

https://learn.microsoft.com/en-us/microsoft-365/enterprise/configure-exchange-server-for-hybrid-mode... 

what else would need to setup for CA to control mailbox hosted on exchange server. 

[#6]

Are the devices Intune managed?

[#7]

@Vasil Michev 

Not at this time, only couple pc managed by Intune, most all of them are SCCM managed. May I know CA only applicable to those managed by Intune?  

[#8]

If the idea is to restrict access based on the device compliance, Intune is a requirement. Otherwise, you should be able to use other conditions.

[#9]

Got it, thank you for your input and we have the ideas to move on this path.