Question

Your organization uses Microsoft Entra ID P2 and Microsoft Intune. Finance department users access a sensitive payroll web app that is registered in Entra ID. Security requires that these users can only reach the app from Intune-managed devices that are marked compliant, and that they must re-authenticate every 4 hours regardless of persistent browser sessions. You need to enforce both requirements with the least administrative effort. What should you configure?

Accepted Answer

A single Conditional Access policy targeting the payroll app that grants access with the 'Require device to be marked as compliant' control and configures a session control for sign-in frequency of 4 hours.

Answer

An Intune device compliance policy that blocks non-compliant devices, plus a mailbox retention policy set to 4 hours.

Answer

A Conditional Access policy requiring MFA for all users, and a separate Entra ID Protection sign-in risk policy set to re-prompt every 4 hours.

Answer

A Conditional Access policy that requires a Hybrid Entra joined device and enables 'Persistent browser session' set to 'Always persistent'.