Conditional Access blocks unknown device platforms

​

What this check verifies

Microsoft Entra Conditional Access can block sign-ins from device platforms that the organization does not recognize or support. A policy that includes all platforms and excludes the known ones (Android, iOS, Windows, macOS, Linux) effectively blocks any unknown or unsupported platform, reducing the attack surface from unmanaged or unexpected devices.

​

Risk

Without blocking unknown device platforms, attackers may authenticate from spoofed or uncommon operating systems that bypass platform-specific security controls. This increases the risk of unauthorized access and makes it harder to enforce device compliance, potentially leading to credential theft or data exfiltration from unmanaged environments.

​

Recommendation

Create a Conditional Access policy that includes all device platforms and excludes the known ones (Android, iOS, Windows, macOS, Linux), then set the grant control to Block access. This ensures that only recognized platforms can authenticate, following a zero-trust approach to device management.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Select New policy.
4. Under Users, include the desired scope. Microsoft recommends All users with appropriate exclusions.
5. Under Target resources, include the applications or resources you want to protect. Microsoft recommends All resources / All cloud apps.
6. Under Conditions > Device platforms, set Configure to Yes.
7. Under Include, select Any device.
8. Under Exclude, select Android, iOS, Windows, macOS, and Linux.
9. Under Grant, select Block access.
10. Set Enable policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-policy-unknown-unsupported-device
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#device-platforms

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_block_unknown_device_platforms. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks