Setup Intune Policies

Overview

This is a small guide on how to set up and use/debug Conditional Access Policies within Intune. By using policies, you define what will actually happen with non-compliant devices. For more information, read the official docs.

Misconfiguring conditional access can keep your users from signing in unintentionally. Relution is not liable for any damages resulting from improper configuration.

Targeting all cloud apps in the target resources with strict policies will also block users from registering their devices.

Note

Relution suggests to:

  • to start with, either
    • using policies in “report-only” mode, instead of directly applying it
    • OR have selected users only to begin with to ensure it works as expected
  • never select All cloud apps in the target resources. Selecting All cloud apps with strict policies will block users from being able to register their device. As of today, the Microsoft Broker app can’t be selected in the exclude filter, which always needs to be enabled.

Example setup

Policies can be configured in Intune > Endpoint security > Conditional Access > Policies.

See the following screenshot as example: Basic Policy Setup

  1. select the users which should be affected
  2. select the resources which should be affected
  3. in this example, we used the teams services
  4. as a grant, we decided that devices have to be compliant
    • Basic Policy Setup Grant
  5. for testing purposes, we set the policy to Report-Only

Security Defaults

Chances are you might receive an error, stating that security defaults must be disabled before you can enable conditional access policies. The official microsoft docs will tell you more about if you should switch to conditional access or not.

If you’re sure to disable them, you can click on disable security defaults, select disabled and My organization is planning to use conditional access. Security Defaults

Debugging

In the Sign-in logs view in Entra/Intune it is possible to see if Conditional Access policies were applied or not.

Policy Debug

Additionally, Microsoft offers a What If tool.