Office365 Mobile access to only Exchange & Teams and Conditional Access Query

[mrmule]

Hi All,

 

Firstly, thank you for checking out my query and thank you in advance for any input you may have. I am looking for a little advice if possible regarding Office365 and permitting mobile phones to only be permitted access to Exchange and Teams.

 

We will likely need to at some point enroll them into intune device management at some point, however as they are iOS this will mean factory resetting the devices thus this is not acceptable at present. I would like to allow certain users the ability to add exchange email and teams to their mobile device, blocking access to all other paps, I particularly wish to block access to Sharepoint or onedrive on these mobile devices.

 

I currently have two core conditional access policies which are assigned to all users (with exclusions):

 

1. Require Compliant Device for ALL Apps.

2. Require MFA for ALL Apps.

 

The mobile users who require email and teams on their mobile device are excluded from the policy (1) requiring compliant device.

 

Is it my understanding that I should now create two new CA policies assigned to the mobile users:

 

1.CA policy requiring a compliant device for ALL apps with the exception of exchange and teams. This should then block access to anything other than exchange or teams from the mobile devices.

2. CA policy targetting Android & iOS forcing MFA, Approved Apps & App Protection Policy

 

I have an app protection policy for iOS and Android, enfocing a password for apps and blocking copy and paste etc.

 

Does this sound like an acceptable way of securing these mobile devices?

 

Any thoughts greatly appreciated.

 

Thanks

MM

[chaplic]

Assume you know that you can do fairly basic device manamgent with intune withouth a device wipe, assuming it doesnt have MDM already

 

Given teams in parts is a mashup of exchange and sharepoint, I recall issues if sharepoint is blocked, so you may wish to include edge in your app protection policy and allow sharepoint access