What this check looks at
Checks for a Conditional Access policy that requires device compliance or hybrid Entra join.
Device compliance only protects data when access depends on it. Conditional Access can require that a sign-in comes from a device Intune reports as compliant (Require device to be marked as compliant) or from a device joined to both on-premises Active Directory and Microsoft Entra ID (Require Microsoft Entra hybrid joined device). Without such a policy, a valid password and an MFA approval reach Microsoft 365 from any computer anywhere.
This check applies where the tenant holds an Intune service plan. It looks for an enabled Conditional Access policy, switched On rather than report-only, whose grant controls require a compliant or hybrid joined device. The check fails when there is none.
Without it, staff sync OneDrive and download attachments onto home PCs, shared family computers and hotel business-centre machines, outside the organisation’s encryption, patching and remote-wipe controls. It is also one of the few controls that stops adversary-in-the-middle phishing: the attacker’s relay server cannot present a compliant device, so a relayed sign-in fails even when the user approves MFA.
Why it matters
Compliance data without enforcement changes nothing. Requiring a managed device is the control that stops corporate data being pulled onto personal, unpatched machines.
At a 70-person law firm, a solicitor syncs client files to a home desktop shared with their children. The desktop picks up an information stealer that uploads saved passwords and documents, and client correspondence later appears on a ransomware group’s leak site. With a compliant-device requirement, the home desktop could never have synced OneDrive in the first place.
The same policy blocks most adversary-in-the-middle phishing, the technique behind much of today’s business email compromise. Access from personal devices can still be allowed in a controlled way, through browser-only sessions or app protection policies on phones.
CIS Microsoft 365 Foundations Benchmark 5.2.2.9 asks for a managed device to be required for authentication, and CISA SCuBA MS.AAD.3.7 asks for managed devices to be required. Cyber Essentials’ secure configuration requirement, CIS Controls v8 safeguard 4.1, ISO 27001 A.8.1 and A.5.15, the NCSC CAF device management outcome and the Essential Eight device hardening guidance all assume only managed devices reach company data.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Make sure every Windows and Mac in use is enrolled and compliant first, or users will be blocked.
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Check device readiness first. In the Microsoft Intune admin centre, check that every Windows PC and Mac in use appears under Devices > All devices and is compliant (Reports > Device compliance). Anyone whose only computer is unmanaged will be blocked: bring those devices under management, replace them, or agree how that person will work (browser-only access, a managed loan device).
- Prepare browser sign-in on Windows and Mac. Make sure people use Microsoft Edge signed in with their work profile, or have the Microsoft Single Sign On extension in Chrome on Windows. On Macs, deploy Company Portal and configure the Microsoft Enterprise SSO plug-in through Intune. Without these, browsers cannot pass on the device’s compliance and compliant devices are blocked too.
- Create the policy in report-only mode. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy and name it, for example, "Require compliant or hybrid joined device - Windows and macOS". Under Users, include All users and exclude your emergency access accounts and All guest and external users. Under Target resources, choose Office 365 (or All resources). Under Conditions > Device platforms, set Configure to Yes and include Windows and macOS. Under Grant, tick Require device to be marked as compliant and Require Microsoft Entra hybrid joined device, choose Require one of the selected controls, set Enable policy to Report-only and select Create.
- Review the report-only results. After at least a week, open Entra ID > Monitoring & health > Sign-in logs and review sign-ins on Windows and macOS, opening the Report-only tab for each. Every Report-only: Failure is someone who would have been blocked: check whether the device is unmanaged, not yet compliant, or using a browser that cannot pass device information, and fix it.
- Tell users before you enforce. Tell staff the date access from unmanaged computers ends, how to get help, and what route exists for personal devices (browser-only access, or apps on a phone protected by app protection policies).
- Switch the policy on. Open the policy, set Enable policy to On and Save. Watch the sign-in logs and the helpdesk queue on the first day and fix individual devices rather than adding broad exclusions.
- Confirm unmanaged computers are refused. Sign in from an unmanaged Windows or Mac computer: access should be refused with a message that the device must be managed. From a compliant device, the sign-in log’s Conditional Access tab should show the policy as Success. The finding clears at the next assessment.
What users will notice
Microsoft 365 can only be used from company-managed Windows and Mac devices. Personal computers are blocked (browser access can be allowed separately).
How to confirm it worked
Sign in from an unmanaged computer: access is blocked with a message about device compliance.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Secure configuration |
| Cyber Essentials Plus | Secure configuration |
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.5.15 Access control |
| CISA SCuBA | MS.AAD.3.7v1 Managed devices required for authentication |
| CIS M365 | 5.2.2.9 Ensure a managed device is required for authentication |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticatedPR.IR-01: Networks and environments are protected from unauthorized logical access and usage |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Require compliant devices (Microsoft Learn)