Deploy app to compliant devices only

[stromnessian]

I'm probably missing something obvious, but I was wondering how I could deploy an app or configuration profile and limit it to compliant devices.  Conditional access obviously isn't the solution as it's only for accessing cloud apps.  I guess a dynamic group wouldn't work either as it'd require Intune enrollment to get the compliance data.  Any ideas?

[#2]

Hi stromnessian,

I thought Non-compliant devices will not receive apps or config policies from Intune anyways, do you see different experience?


Moe

[#3]

@Moe_Kinani yes, non-compliant devices receive apps/config profiles the same as compliant ones do.

Regards

Keith 

[#4]

@stromnessian  Doesn't the device need to enroll with Intune to be identified as compliant/non-compliant? You're right about not being able to use Dynamic AAD group though, because device compliance is not an available Property for creating the dynamic membership rule.

[#5]

Hi Keith,

Thanks. I don’t see any other ways that you can achieve the objective. As you mentioned, CA can block access to resources, not what you looking for.

Moe