Entra Joined Laptop - Block Logins from outside a trusted location

[2097]

Hi , I have researched this and cant really find a answer - 

 

We have lots of new laptops trolleys for "Internal Use" only , I want to prevent these ( Laptops ) from being taken home . We currently have a department that do this despite being told not to .

 

I’m trying to find a conditional access policy that prevents this , But it seems Login ( Especially if already Cached ) will still allow them to login fine .

 

Anyone done anything similar ?

 

Thanks

 

 

 

[Frodo_Baggins]

20 minutes ago, 2097 said:

Hi , I have researched this and cant really find a answer - 

 

We have lots of new laptops trolleys for "Internal Use" only , I want to prevent these ( Laptops ) from being taken home . We currently have a department that do this despite being told not to .

 

I’m trying to find a conditional access policy that prevents this , But it seems Login ( Especially if already Cached ) will still allow them to login fine .

 

Anyone done anything similar ?

 

Thanks

 

 

 

Would be interested in this for other related reasons, when I looked I saw conditional access and forced web sign in at the Windows login screen as a possible solution

[3s-gtech]

Can you restrict the wifi settings in any policy, so that they can only join your SSID? Make them useless off-site.

[psydii]

Not sure exactly how with intune, but with ad/gp, set cached logins to zero and set the lid close action to restart or shutdown. 
 

For Entra, maybe: conditional access, (test user)  all resources network, condition include the set of laptops, exclude your lan/location, access control block access. 

 

be very careful not to lock yourself out of your tenant messing with the above. I haven’t tested it at all and only vaguely think it might work.

 

 

[2097]

On 11/06/2026 at 10:27, 3s-gtech said:

Can you restrict the wifi settings in any policy, so that they can only join your SSID? Make them useless off-site.

 

Thank you , Thats what i did in the end .

 

Blocked all other SSID , Blocked login page of changing the SSID

 

password protected boot menu etc .