Question

A financial services company allows employees to access Microsoft 365 and internal SaaS apps from both corporate and personal devices. Security requires that when users access a highly sensitive expense-approval app from an unmanaged device, they must reauthenticate every hour and be prevented from downloading or printing content. Access from compliant, Intune-managed devices should retain normal sign-in frequency. The solution must apply only to the expense-approval app without affecting other apps. What should you recommend?

Accepted Answer

Configure a Conditional Access policy targeting the expense-approval app that grants access with a session control for sign-in frequency of 1 hour and enforces app-enforced restrictions or Defender for Cloud Apps session policies, combined with a device-filter condition.

Answer

Configure a tenant-wide sign-in frequency of 1 hour in Conditional Access session controls and enable continuous access evaluation for all cloud apps.

Answer

Set the organization-level token lifetime policy to 1 hour using PowerShell and block downloads through an Intune app protection policy applied to all managed devices.

Answer

Create an Azure AD Identity Protection risk policy that forces reauthentication when a user signs in from an unmanaged device and blocks file access.