Conditional Access Policies on BYOD

[petben]

We want to apply a couple of Conditional Access polices on (a few) users personal devices. e.g. 'Allow access outside the UK'.

 

The thing is we need a rule to find these devices to apply the rule to. They are 'Registered' in Entra, but this is not enough to require for the rule to apply as registering a device is not very secure. So we then tried also adding an ExtensionAttribute requirement, but these only apply in Conditional Access policies if the device is managed in Intune.

 

Any ideas how we can apply a Conditional Access policy to BYOD? We dont want to go down the road of Intune managing users personal devices..

[bicky]

Conditional Access Policy: Conditions >> Filter for devices >> Exclude filtered devices from policy

device.deviceOwnership -eq "Company"

 

 

[TechMonkey]

Could you not put the users in a group and exclude them? Or apply the policy to them?

[jmak]

I think what you need is MAM-WE: Mobile Application Management Without Enrollment. 

You then need linked Conditional access policies which allow access from your managed devices, but if it's not a managed device, then the school's data can only be accessed through one of the approved apps. You should then also apply Microsoft Defender for Endpoint policies to attest the security status of the Android device. 

 

The Conditional Access Policy forces use of approved apps

The MAM-WE policy checks the status of the apps and calls the Defender policy

The Defender policy attests the security level of the device

 

This approach "registers" the apps rather than the device, so you're not entertaining the device in your MDM.

 

 

[T_Lister]

I'm currently looking at blocking out Windows 10 and lower with none enrolled devices, but it just does a blanket block, even on my enrolled devices.  From this thread I'm getting the impression that Microsoft are forcing apps and blanket block browsers.  Therefore any A1 license is not going to be able to use a personal device unless we implement an approved browser like Island Enterprise?