Question

Contoso uses Microsoft Intune and Microsoft Entra ID. All corporate Windows and iOS devices are enrolled in Intune and evaluated by compliance policies. Management requires that users can only access Microsoft 365 services (Exchange Online and SharePoint Online) from devices that Intune reports as compliant. Non-compliant or unmanaged devices must be blocked, and you want this enforced at sign-in time. What should you configure?

Accepted Answer

A Conditional Access policy targeting the Office 365 cloud apps with a grant control that requires the device to be marked as compliant

Answer

An Intune compliance policy with the action 'Mark device noncompliant' set to zero days

Answer

A device configuration profile that restricts access to Exchange Online and SharePoint Online

Answer

An Intune enrollment restriction that blocks personal devices from enrolling