Conditional Access and Intune Protection policy

[mikhailf]

Hello Community, 

This question is about Conditional Access and Intune Application Protection policy.

What if I have a Conditional Access policy that requires app protection policy applied on devices to access resources using Microsoft Apps (Outlook, Word, Excel, SharePoint, etc.). 

What happens when I have a new user created and this user is trying to log into an app on his phone?

The new user won't get the App Protection policy until he logs in however, he can't log in because he has no app protection policy enabled.

Could anybody send me a reference or tell about his/her experience?

[#2 · Accepted solution]

@mikhailf In this type of situation, the user will be guided to gain access anyway. So in this case, app protection is received. The same money if you enforce MFA or Complaince. The user is then guided to get this ready

[#3]

If this sufficiently answers your question, mark the answer as accepted! :)

[#4]

Hello @JosvanderVaart,

I managed to log into Outlook, however it didn't work with MS Teams.

I got the error message that the app should be protected with an Intune policy. In my environment the App Protection policy is applied for All Microsoft apps (and I believe Teams is a part of this).

It also didn't work for Microsoft OneDrive app. 

"The app must be protected with an Intune policy before you can access company data. Please contact your IT help desk for more information".

How is it supposed to work?

[#5]

If the app protection policies and conditonal access rules are right then this configuration would be started after the first authentication. So to answer your question, can you share your configuration with us?

[#6]

I apologize. The app protection policy was applied only for Outlook. I will switch this to All Microsoft Apps and test again.