Forum Discussion

hollash's avatar
hollash
Copper Contributor
Feb 21, 2022

Conditional access, all cloud apps, device compliance

Hi,

 

We have company windows devices managed by intune with a compliance policy. I want to prevent non-compliant devices from accessing any application including all Microsoft cloud apps and third-party SaaS apps that we've configured to use AD SSO authentication.

 

I think I need a conditional access policy with:

  • Cloud apps or actions > Include: "All cloud apps" 
  • Grant > Grant access: "Require device to be marked as compliant"

 

The things I'm unsure of are:

  1. whether this will block our third-party SaaS apps using SSO
  2. whether I need to exclude any apps from the policy to allow new devices to enroll with Intune or devices that become non-compliant to fix their compliance issue (e.g. Microsoft Defender up to date) and re-register as compliant.

Any advice would be much appreciated.

Thanks in advance.

azure
Conditional Access
  • Jai Verma's avatar
    Jai Verma
    Brass Contributor
    Mar 02, 2022
    All cloud app include third-party SaaS apps integrated with Azure AD. (not all Microsoft apps are onboarded to CA Policies, there are some Micro services, which does not cover).
    You need to exclude Microsoft Intune Enrollment from this policy.
    I suggest you go for deployment in phased manner,

    - In the fist phase, keep the policy in report only mode and analysis the data, particularly who are blocked by this policy and understand why.
    Phase 2 - Enable the policy for a group of users, (mostly your team members or IT Staff)
    Phase 3 - Enable policy for larger group
    Phase 4 - Enable for all

Resources