Intune Shared iPad & Conditional Access

[Olliedawg]

For our staff we completely block access to Office 365 via conditional access, unless you have one of the following.

- Hybrid joined device

- Compliant Device

 

This is great & ensures that school data can only be accessed on school owned devices, however I'm running into an annoying gripe with Intune Shared iPads. 

 

Due to the conditional access policy/policies* - the Shared iPad is never allowed to access 365 as conditional access blocks it (besides from our trusted location which is the schools LAN).

 

I've tried excluding a test user from the policy & signing in as that user, I've tried excluding the share ipad enrolment profile from the policy too, none of this seems to work.

 

Basically I want the staff that are going on our Italy ski trip to be able to take a school owned iPad with them, and sign into it & use outlook, teams, our MIS etc..

 

Is there any other way to go about this?

 

Edited February 5 by Olliedawg

[psydii]

Have a more specific conditional access policy for staff on the ipads that, say, just requires MFA?  Or have a completely separate configuration profile for two ipads just for the trip?

[Olliedawg]

2 minutes ago, psydii said:

Have a more specific conditional access policy for staff on the ipads that, say, just requires MFA?  Or have a completely separate configuration profile for two ipads just for the trip?

We're still fairly new with Intune - Could you please elaborate on the additional conditional access policy - would this not conflict with the existing?

 

If the device is enrolled as a 1:1 device, would this then meet the "compliant" criteria? I've read that shared iPad mode is not officially supported by microsoft CA policies which are using "require compliant device"... bummer

 

[psydii]

never done it with managed iPads, so was just throwing a load of ideas that might help when searching. But here's what I'd look into as next steps:

 

Make sure you deploy a require PIN policy to those two ipads, because otherwise anyone who picks them up would get access to what ever was signed in.

 

Exclude those specific ipads from your general CA policy with something like

devices don't match (device.deviceId -eq "<ID of iPad 1>") OR (device.deviceId -eq "<ID of iPad 2>")

 

then create a temporary CA Policy for  "those  two specific users on those two specific devices must have strong mfa" 

 

I really have probably got some of this wrong - I've got a very simple set up with CA Policies here and it was years ago when I set them up.

 

 

 

[Olliedawg]

8 minutes ago, psydii said:

never done it with managed iPads, so was just throwing a load of ideas that might help when searching. But here's what I'd look into as next steps:

 

Make sure you deploy a require PIN policy to those two ipads, because otherwise anyone who picks them up would get access to what ever was signed in.

 

Exclude those specific ipads from your general CA policy with something like

 

devices don't match (device.deviceId -eq "<ID of iPad 1>") OR (device.deviceId -eq "<ID of iPad 2>")

 

then create a temporary CA Policy for  "those  two specific users on those two specific devices must have strong mfa" 

 

I really have probably got some of this wrong - I've got a very simple set up with CA Policies here and it was years ago when I set them up.

 

 

 

Appreciate it I’ll give it a go when I’m back at work on Monday. 
 

if not I’ll go down the 1:1 route, we have a few spare iPads anyway.