Question

A company uses Microsoft Entra ID for identity and has integrated several SaaS applications for single sign-on. Security requires that access to a sensitive HR SaaS application be permitted only from corporate-managed devices that are compliant with Intune policies, while personal or unmanaged devices must be blocked entirely. The solution must not require any changes to the SaaS application itself. What should you recommend?

Accepted Answer

Create a Conditional Access policy targeting the HR application that grants access only when the device is marked as compliant or Hybrid Azure AD joined.

Answer

Assign the HR application to a security group and require Privileged Identity Management activation for all users before access.

Answer

Configure a Microsoft Entra access package with an approval workflow so users request time-limited access to the HR application.

Answer

Enable per-user MFA on all HR application users and enforce a strong password policy through the on-premises domain controller.