Corporate data access only on company devices

[null null]

Need policy where admin can decide which device or only company devices can access corporate data. We have created conditional access policy where access is provided if device is compliant, but user is installing company portal on personal devices, making device compliant and accessing data. So how to restrict this to only company devices?

[#2]

@null null 

You are looking for enrollment restrictions (https://docs.microsoft.com/en-us/intune/enrollment/enrollment-restrictions-set).

Here you can specify if personal devices can be enrolled. Set this to no for the desired Operating Systems

[#3]

Hi @null null 

 You can block access by using custom policy with Cloud App Security, then apply control by “Presence of client certificates in a trusted chain”. 

Check this article for more info. 

Hope it helps!
Moe