What this check looks at
Checks for an enabled Conditional Access policy for all users and all resources whose only grants are a compliant or a hybrid-joined device, on every platform.
Conditional Access can require a sign-in to come from a device the organisation manages: one marked compliant by Intune, or one that is Microsoft Entra hybrid joined (joined to the on-premises domain and synchronised). With that in place, a correct password and MFA are not enough; an attacker would also need a managed device.
The check, for tenants with Entra ID P1, looks for an enabled policy that targets All users and All resources on every device platform, whose only grant controls are Require device to be marked as compliant and/or Require Microsoft Entra hybrid joined device, as alternatives. Microsoft’s common template that also accepts MFA as an alternative does not count, because MFA alone then satisfies it. The check warns when such a policy is only in report-only mode and fails when there is none.
Without it, company data can be reached from any device: a personal laptop with no updates or antivirus, a shared home PC, or an attacker’s machine replaying a stolen session. Data synced to an unmanaged device cannot be wiped when someone leaves, and malware on it can steal tokens that then work from anywhere.
Why it matters
When company data can only be reached from managed devices, a stolen password and MFA approval are not enough: the attacker also needs a device the organisation manages. It also keeps data off personal machines nobody patches.
In token-theft attacks the attacker steals an employee’s session and replays it from their own machine. Where every sign-in must come from a compliant device, the replayed session fails the device check. The same policy ends the common situation where a leaver’s personal PC keeps syncing OneDrive long after their last day.
It is the most disruptive policy in the baseline: every device anyone uses for work must be managed by Intune and compliant first, phones included. A rushed switch-on locks people out, so most of the work is preparation and chasing the last non-compliant devices; the enrolment of the devices themselves is covered by the device findings.
The CIS Microsoft 365 Foundations Benchmark (5.2.2.9) and the CISA SCuBA baseline (MS.AAD.3.7v1) both ask for a managed device to be required for sign-in, and Cyber Essentials expects company data to be reachable only from devices that meet a defined secure configuration. The rule maps to NIST CSF 2.0 PR.AA-03.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Every device people use must be enrolled in Intune and compliant (or hybrid joined) first; check the Intune compliance report.
- Decide how guests and personal devices will work: exclude guests, or give them browser-only access through a separate policy.
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Check every device is managed and compliant. In the Microsoft Intune admin centre, open Devices > All devices and the device compliance report (Reports > Device compliance). Every Windows, macOS, iOS and Android device people use for work must be managed by Intune and compliant, or hybrid joined. List the people whose devices are not, and enrol those devices before going further.
- Decide how guests and personal devices will work. Guests cannot use your managed devices, so exclude them (Users > Exclude > Guest or external users) and cover them with a separate MFA policy. Decide whether personal phones may be used; if so they must enrol, because this check needs the policy to cover every platform.
- Create the policy in report-only mode. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy, named "CA – All users – Require compliant or hybrid joined device". Users: All users, excluding the emergency access group and guests. Target resources: All resources. Leave Device platforms not configured. Grant: Grant access, tick Require device to be marked as compliant (and Require Microsoft Entra hybrid joined device if the client has hybrid joined PCs) with Require one of the selected controls. Do not add MFA as an alternative. Set Enable policy to Report-only.
- Review the report-only results. After a week or two, look through Entra ID > Monitoring & health > Sign-in logs for sign-ins this policy would have blocked, on the Report-only tab. Each is a person or device to fix: a phone not yet in Intune, a browser that does not pass device information (use Edge, or Chrome with the Microsoft Single Sign On extension), or a device that has fallen out of compliance.
- Test with an unmanaged device. Run What If (Conditional Access > Policies > What If) for an ordinary user, or sign in from a personal browser, and check the policy applies to the sign-in.
- Tell staff and switch the policy on. Tell staff the date from which company apps work only on company-managed devices, and how to enrol a phone if that is allowed. Then set Enable policy to On and select Save, at a time when the service desk can respond.
- Confirm. Watch the sign-in logs for genuine failures over the first days and fix each one. Re-run the assessment: it passes when an enabled policy requires a compliant or hybrid joined device for all users, all resources and every platform.
What users will notice
Sign-ins from devices that are not compliant or hybrid joined are refused, for every app. Personal devices stop working unless enrolled.
How to confirm it worked
Run the What If tool for a user on an unmanaged device: the policy applies and blocks. The policy state is On.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.5.15 Access control |
| CISA SCuBA | MS.AAD.3.7v1 Managed devices required for authentication |
| CIS M365 | 5.2.2.9 Ensure a managed device is required for authentication |
| CIS Controls v8.1 | 6.7 Centralize access control (IG2) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access managementAsset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Require compliant or hybrid-joined devices (Microsoft Learn)