MFA proves who is signing in. It says nothing about the device they are using. A stolen password plus a phished MFA prompt on an attacker’s laptop still looks like a valid sign-in. Requiring device compliance in Conditional Access closes that gap: only devices that are enrolled in Intune and meet your health rules can reach company data.
This guide covers how the link between Intune and Conditional Access works, how to build the policy, how to handle phones and personal devices, and what to check when a user is blocked.
How the two pieces fit together
Intune evaluates each enrolled device against its compliance policies and writes the result to the device object in Microsoft Entra ID. When a user signs in, Conditional Access reads that compliance flag and decides whether to grant access.
Intune compliance policy: defines what “healthy” means (BitLocker on, supported OS, Defender running, acceptable risk score).
Conditional Access policy: requires the grant control Require device to be marked as compliant for chosen users and apps.
Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5. Without a well-built compliance policy, this control is meaningless, so start there. If you have not yet changed the tenant-wide setting that marks devices with no compliance policy as compliant, do that first.
Prerequisites checklist
Every platform you allow has a compliance policy assigned in Intune.
“Mark devices with no compliance policy assigned as” is set to Not compliant.
You have reviewed the compliance report and fixed the obvious failures.
You have at least two emergency access (break-glass) accounts that are excluded from every Conditional Access policy and protected with strong, monitored credentials.
You know which devices are unmanaged today: personal phones, home PCs, contractors.
Building the policy step by step
Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator and go to Entra ID > Conditional Access > Policies > New policy.
Name it clearly, for example CA010 – All users – All resources – Require compliant device.
Under Users, include All users. Exclude your break-glass accounts and, if you use Entra Connect or Cloud Sync, the Directory Synchronization Accounts role.
Under Target resources, include All resources. Avoid scoping to a few apps; attackers go wherever the gap is.
Under Conditions > Device platforms, decide whether this policy covers all platforms or only Windows and macOS (see the mobile section below).
Under Grant, select Require device to be marked as compliant.
Set Enable policy to Report-only and create it.
Requiring a compliant device does not block Intune enrollment itself, so new devices can still enroll and become compliant.
Handling phones and personal devices
This is where most rollouts get stuck. A single “compliant device for everything” policy forces every phone to enroll in Intune. That is fine for company-owned phones but often unacceptable for staff using personal devices. A common pattern splits the policy by platform:
Platform
Grant control
Notes
Windows, macOS
Require device to be marked as compliant
Company devices only; personal PCs use browser-only access or are blocked
iOS, Android
Require device to be marked as compliant or Require app protection policy
Corporate phones enroll; personal phones use Outlook, Teams and Edge with app protection
Unknown or unsupported platforms
Block
Stops attackers spoofing an unusual user agent to dodge the rules
For the mobile policy, select both controls and choose Require one of the selected controls. The block policy for unknown platforms is easy to overlook and important: without it, a client that reports an unrecognized platform may fall outside your device rules.
Browser access from unmanaged PCs
If staff need occasional webmail from a home PC, you can allow browser access with Conditional Access app control or app-enforced restrictions that block downloads, rather than full access. Decide this deliberately and document it. “Just exclude that user” is how exceptions turn into holes.
Reviewing report-only results
Leave the policy in report-only mode for one to two weeks. Then review:
Sign-in logs in Entra ID, filtered by the policy name, showing “Report-only: Failure”. Each one is a sign-in that would have been blocked.
The Conditional Access insights and reporting workbook, which summarizes impact by user, app and device state.
Device state in each failed sign-in: “Unregistered” means an unmanaged device; “Not compliant” means an enrolled device that fails a rule.
Fix the enrolled devices that fail, decide what to do about the unmanaged ones, and communicate the change to staff before you switch to On. Enforce for a pilot group first, then everyone.
Troubleshooting a blocked user
When someone reports “I can’t get into Outlook” after enforcement, work through this order:
Check the sign-in log entry. The Conditional Access tab shows which policy blocked them and why.
Check the device in Intune. Is it enrolled? Which compliance setting fails? A pending Windows update or BitLocker suspended after a firmware update are common causes.
Check the device identity. On Windows, dsregcmd /status should show the device as Entra joined or hybrid joined. A device that is enrolled but not correctly registered cannot pass a compliance check.
Check the browser. On macOS, iOS and some non-Microsoft browsers, Entra ID identifies the device with a client certificate. The user must select it when prompted, or use Edge signed in to the work profile.
Sync and re-evaluate. Once fixed, have the user sync from Company Portal so Intune recalculates compliance.
Frequently asked questions
What license is needed to require a compliant device in Conditional Access?
Conditional Access requires Microsoft Entra ID P1, and device compliance requires Intune. Both are included in Microsoft 365 Business Premium, E3 and E5.
Will requiring device compliance block new devices from enrolling?
No. Microsoft designs the Require device to be marked as compliant control so it does not block Intune enrollment, so new devices can enroll and become compliant.
How do I let staff use personal phones without enrolling them?
Create a separate policy for iOS and Android that grants access if the device is compliant or the app has an Intune app protection policy. Personal phones then use Outlook, Teams and Edge with app protection, while company phones enroll.
Not sure whether an attacker’s laptop could reach your Microsoft 365 data today? Book a free Microsoft 365 security assessment and we will test your Conditional Access coverage.
MFA proves who is signing in. It says nothing about the device they are using. A stolen password plus a phished MFA prompt on an attacker’s laptop still looks like a valid sign-in. Requiring device compliance in Conditional Access closes that gap: only devices that are enrolled in Intune and meet your health rules can reach company data.
This guide covers how the link between Intune and Conditional Access works, how to build the policy, how to handle phones and personal devices, and what to check when a user is blocked.
How the two pieces fit together
Intune evaluates each enrolled device against its compliance policies and writes the result to the device object in Microsoft Entra ID. When a user signs in, Conditional Access reads that compliance flag and decides whether to grant access.
Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5. Without a well-built compliance policy, this control is meaningless, so start there. If you have not yet changed the tenant-wide setting that marks devices with no compliance policy as compliant, do that first.
Prerequisites checklist
Building the policy step by step
Entra ID > Conditional Access > Policies > New policy.Requiring a compliant device does not block Intune enrollment itself, so new devices can still enroll and become compliant.
Handling phones and personal devices
This is where most rollouts get stuck. A single “compliant device for everything” policy forces every phone to enroll in Intune. That is fine for company-owned phones but often unacceptable for staff using personal devices. A common pattern splits the policy by platform:
For the mobile policy, select both controls and choose Require one of the selected controls. The block policy for unknown platforms is easy to overlook and important: without it, a client that reports an unrecognized platform may fall outside your device rules.
Browser access from unmanaged PCs
If staff need occasional webmail from a home PC, you can allow browser access with Conditional Access app control or app-enforced restrictions that block downloads, rather than full access. Decide this deliberately and document it. “Just exclude that user” is how exceptions turn into holes.
Reviewing report-only results
Leave the policy in report-only mode for one to two weeks. Then review:
Fix the enrolled devices that fail, decide what to do about the unmanaged ones, and communicate the change to staff before you switch to On. Enforce for a pilot group first, then everyone.
Troubleshooting a blocked user
When someone reports “I can’t get into Outlook” after enforcement, work through this order:
dsregcmd /statusshould show the device as Entra joined or hybrid joined. A device that is enrolled but not correctly registered cannot pass a compliance check.Frequently asked questions
What license is needed to require a compliant device in Conditional Access?
Conditional Access requires Microsoft Entra ID P1, and device compliance requires Intune. Both are included in Microsoft 365 Business Premium, E3 and E5.
Will requiring device compliance block new devices from enrolling?
No. Microsoft designs the Require device to be marked as compliant control so it does not block Intune enrollment, so new devices can enroll and become compliant.
How do I let staff use personal phones without enrolling them?
Create a separate policy for iOS and Android that grants access if the device is compliant or the app has an Intune app protection policy. Personal phones then use Outlook, Teams and Edge with app protection, while company phones enroll.
Device-based access control works best alongside strong identity controls. See our MFA enablement service, BYOD for Microsoft 365 for personal devices, and the Microsoft 365 security assessment for a full review. Microsoft’s template is described in Require device compliance with Conditional Access.
Not sure whether an attacker’s laptop could reach your Microsoft 365 data today? Book a free Microsoft 365 security assessment and we will test your Conditional Access coverage.