Conditional Access requires an MDM-compliant device

​

What this check verifies

An enabled Conditional Access policy enforces Require device to be marked as compliant for all users across all cloud apps with no application exclusions. This check also verifies that Intune has assigned compliance policies and at least one currently reported compliant MDM-managed device. If Graph exposes tenant settings, it also checks secure-by-default evaluation.

​

Risk

Without a mandatory MDM-backed compliant device requirement, users can access cloud resources from unmanaged or non-compliant devices. If Intune compliance policies are missing, unassigned, or devices without policy assignment can remain compliant, Conditional Access can create a false sense of protection and increase the risk of credential theft and data exfiltration.

​

Recommendation

Enforce a Conditional Access policy requiring all users to access cloud applications only from MDM-compliant devices. Back that policy with Microsoft Intune device compliance policies that are actually assigned, configure Intune so devices without a compliance policy assignment are treated as Not compliant, and verify that at least one device is currently enrolled and reporting a compliant state through an MDM/Intune management channel. If Microsoft Graph exposes Intune tenant settings, also confirm the tenant reports secure-by-default compliance evaluation.

​

Remediation

Dashboard steps

1. Sign in to the Microsoft Intune admin center https://intune.microsoft.com with a role that can manage device compliance and enrollment.
2. Confirm the tenant has Microsoft Intune enabled and the target users have the required Microsoft Entra ID P1 or P2 and Intune licensing needed for Conditional Access with compliance.
3. In Intune, go to Devices > Compliance > Policies and select Create policy.
4. Choose the target platform, configure the compliance settings your organization requires, review the configuration, and save the policy.
5. Open the new compliance policy, go to Assignments, and assign it to the users or devices that must satisfy the MDM-compliant device requirement.
6. In Intune, go to Endpoint security > Device compliance > Compliance policy settings.
7. Set Mark devices with no compliance policy assigned as to Not compliant so devices without policy assignment cannot be treated as compliant.
8. Configure or confirm an enrollment path for at least one supported platform. For a lab, the simplest path is usually a Windows device enrolled through Company Portal.
9. Enroll at least one device into Intune MDM, complete registration, and allow the device to sync.
10. In Intune, verify the enrolled device appears under Devices as managed through an MDM/Intune management channel and that its compliance state becomes Compliant.
11. Sign in to the Microsoft Entra admin center https://entra.microsoft.com.
12. Go to Protection > Conditional Access > Policies and select New policy.
13. Under Users, include All users. This check does not evaluate excluded users, but it does require All users to be included.
14. Under Target resources, include All cloud apps and do not exclude applications.
15. Under Grant, select Grant access and enable Require device to be marked as compliant.
16. If you add extra grant controls such as MFA, configure Require all the selected controls and do not weaken the policy with Require one of the selected controls.
17. Set Enable policy to On and create the policy after validating impact.
18. If TigerGate uses an application identity to read Intune, grant and consent the Microsoft Graph permissions DeviceManagementServiceConfig.Read.All, DeviceManagementConfiguration.Read.All, and DeviceManagementManagedDevices.Read.All so the Intune portion of this check can be verified.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant
• https://learn.microsoft.com/en-us/intune/intune-service/protect/device-compliance-get-started
• https://learn.microsoft.com/en-us/intune/intune-service/protect/conditional-access
• https://learn.microsoft.com/en-us/windows/client-management/mdm-overview
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_mdm_compliant_device_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks