In the past, I have been able to push out an email configuration profile and a device compliance policy (as seen below) to require a managed email account in order to enforce a managed device compliance. Along with this, we have then been able to have a conditional access policy that locks down access to Exchange Online to compliant devices - ensuring devices must be enrolled in Endpoint Manager to access company email.
However, in an effort to move users to the much improved Outlook app and a consistent use of modern authN, I have not been able to get the above configuration to work the way that we would expect.
What I have tried for iOS/iPadOS devices (to replace the email configuration profile using basic authN), is created an app configuration policy for Outlook and kept my compliance policy and conditional access policy the same as before, only to hit a wall when trying to access email via Outlook after enrolling a device via the Company Portal app (see below). Essentially, the device isn't compliant because it doesn't have a managed email profile, thus CA blocks the user from accessing Outlook. But I can't have a compliant device unless unless I have a managed email profile on the device (chicken before the egg scenario). If I change the Unable to set up email on the device setting in the compliance policy to Not configured, this resolves the issue, but then we lose that compliance check.
From this, I am seeing that an app configuration policy is not the equivalent of an email configuration policy from a "managed email profile" perspective.
I'm am looking for guidance to see if the type of configuration above is possible if we start to:
- Make the Outlook app the primary email app for accessing company email
- Have a device compliance policy where we "require" a managed email profile
- Via Conditional access, only allow access to Exchange Online if it is from a compliant device (iOS/iPadOS/Android)
Thanks!
