Explaining to the IT Manager: protecting business data on employee owned devices

[Anthony Murfet]

In trying to plan for a OD4B deployment, I have done a lot of testing with MAM and WIP, both enrolled and not enrolled, and now Conditional Access ... ...despite searching high and low, I still cannot find a solution to what appears to be a gap in Microsoft's protection coverage - with all these technologies in place, I can still simply go to a fresh WIn 10 device, log in to it, and because it's not enrolled, I can simply connect with OD4B and download all the data which is otherwise protected on an enrolled/unenrolled device! If I have a contractor resource that will resist enrollment, how do I prevent that contractor from doing what I've just described? There doesn't appear to be an ability to simply block OD4B Sync on an unenrolled device by user or group. Or have I missed something in my search?

[#2]

Condictional access will do what you are wanting. It may not be working as you expect for a number of reasons. There may be trusted ips configured so if you are testing on a trusted network, it will not enforce condictional access.

Also, other somewhat obvious factors include not deploying the policy to user account you are tying to condiction and allowing access for MFA enabled accounts "or" compliant device.

[#3]

A conditional access policy based on network location can do the trick. So can the SPO sync restrictions as detailed here: https://technet.microsoft.com/en-us/library/dn917455.aspx