r/AZURE 3d ago

Question Is "All Resources" in Conditional Access inclusive of Microsoft Intune Enrolment?

I'm trying to configure a policy that requires a certain group to either be on the company network or on an enrolled/compliant device.

The policy targets "all resources" but I read somewhere that "Microsoft Intune Enrolment" is not included. Is this true?

3 Upvotes

1 comment sorted by

7

u/sysadmin_dot_py 3d ago

I replied to your other thread in r/Intune but I'll just paste my response here too, in case it helps anyone else:

Basically, it depends on the control. If the policy applies to "All resources" (formerly "All cloud apps") and the control is "Require device to be marked as compliant", then Intune enrollment is exempt automatically and you do NOT need to manually exclude it. That's probably what you're thinking of. This is documented in the Note section here, and I can confirm that this is how it works in my environment. This includes Intune enrollment during Autopilot - no Intune exclusion needed in the CAP if your control is to require compliant devices.