Block Personal Computers with Conditional Access in Microsoft 365

Wouldn't it be great to just simply block the use of personal computers in Microsoft 365? This would mean that access to Microsoft 365 could only be done on company-owned devices that were part of Intune. You can do this by using a conditional access policy and I will show you in this video.

🧑‍🏫 NEW Course - Discover Microsoft 365 and Get More Done

🆓 FREE Facebook Group
From security to productivity apps to getting the best value from your Microsoft 365 investment, join our Microsoft 365 Mastery Group

🆓 FREE Microsoft 365 Guide
Our FREE Guide - Discover 5 things in Microsoft 365 that will save your business time and money….. and one feature that increases your Cyber Security by 99.9%

💻 Want to Work Together?

😁 Follow on Socials
TikTok @bearded365guy
Instagram @bearded365guy

Chapters
0:00 Introduction
00:36 Basic Conditional Access
01:14 Advanced Conditional Access Policy
02:19 Word of Warning
03:12 Demo
05:09 Create Conditional Access Policy
08:06 Test CA Policy

[SeiferAlmasy]

Very powerful, but not user friendly. We learned to consult this with clients and make them clear what this really means. Our best scenario is to block unmanaged devices to Sharepoint but allow access via the Browser (limited experience). But even this gives issues (not technically but on user level). I am all for it, but this does not work for SMB, mostly. Bu great video again!

[JannievanderWalt]

Dude, your videos are epic! I gained so much knowledge on this topic of CA and App Policies.

[shellpie]

This worked wonderfully for me. I excluded Exchange online, so all cloud apps were blocked except for email and it is doing exactly what I hoped for thanks to this video. Thank you so much Jonathan!

[nottad]

Just found your channel. Loving it. Do you think you could do a full video on setting up a test tenant? Was thrown into supporting Azure after it was setup so would be very helpful setting up my own to learn what I missed and to have something to test.

[nazerbori]

best content, with real world scenarios as usual keep it up

[Jean-MichelRoberts]

Excellent, a useful policy would be able to allow some users to access OWA and Teams from private devices.

Now you could allow users to access OWA and Teams from a web-browser and also access attachments in emails and files stored in Teams (so SharePoint), of course assuming you allow Teams and SharePoint access in the CA.

But how can you prevent files from being saved on the non-corporate device hard drive?

[andrewenglish]

Great info, but how does it work with Hybird Entra installs where AD is installed on-prem?

[daelra]

Excellent. Some great tips here. In the opposite direction, how would you go about setting up Conditional Access for a small startup where everyone is using their own laptops? What would you turn off, what would you leave on? Any special case policies?

[Alkraizer]

Currently running a test with this with Report Only on, do you know if an easy place to see which machines are being reported to have violated this? I think i can see them in the identity sign in page, but curious if there is a better/easier way to view the reports.

in Conditional Access - could a device that's joined to local AD be classified as organization owned? if so how does CA pick this up ? or is it for intune enrolled devices only?

[efraintalamantes]

We use Microsoft Intune to manage Windows devices and Kandji MDM for Apple devices. Is there a possibility to add that into the filtered configurations?

[ifoam]

Johnathan, your videos and style of presentation have been helpful. Does your organization (you) also do live events?

[joeraymen]

We block personal device enrolment and have setup conditional access policy to only allow compliant intune devices. We allow online usage only for personal devices with app enforced restrictions also.

[andrewwitton]

Hi Jonathan, thanks for the great video. I am curious as to your using an OR statement for the filter. Is there an historical reason for using just DeviceOwnership not equals Company?

[mertozsoy]

Hi Jonathan, I'm curious about something. How does Intune detect the device that is not a company computer? You logged in from the incognito tab and tried to access it and it caught you. How did it detect that? Did he check to see if the device was in the domain? If so, how did he do that?

[IronEagle]

Would be great for feedback on still wanting to allow guest access to Microsoft Teams files to other businesses that are approved, they wouldn't have a corporate device?

[rod]

I've implemented all of your CA policies and they're great, but this one blocks re-adding an Autopilot device to Intune after a Wipe. Any suggestions? Thanks

[RoHan-]

Does conditional access generally require the default policies to be turned off to work at all? (that you mention to turn off in the video where you created the 7 policies).

As I did what you did here, but ticked Android additionally, and I am still able to sign in on my personal android and Windows devices to both browser and apps.
Policy is "On"

Any idea what I have missed?

[LetsGo_]

Hello

Could you advise on this please?

If we implement the policy it's effectively saying only inTune managed Windows devices can access Office 365. However, we use dumb terminals to allow users to access Citrix. When we implemented the policy we found that it worked but the knock on effect is that it blocked the use of IGELS and Citrix (hosting a Windows image) to access O365. Can you advise if there is easy work around to this as the IGELS can't be added to inTune.

Thanks

Tim

[nazerbori]

Thank you for this, working like a charm. a question though, what happens to the users logged in already on personal devices? do they get logged out? cause in my testing, the logged in user stayed logged in