Lab 18: Conditional Access Pilot

Overview

Lab 17 established a Windows compliance policy for the Intune pilot devices. This lab used that compliance result in Microsoft Entra Conditional Access so the pilot could evaluate compliant-device access decisions before any live enforcement was applied.

The policy remained in Report-only mode throughout the lab. This allowed the access impact to be validated safely in Entra sign-in logs without blocking pilot users or risking an administrator lockout.

Objective

The objective was to create and validate CA001 - Require compliant device for pilot users, a pilot Conditional Access policy that applies to GRP_Intune_Pilot, targets all Microsoft cloud resources, applies to Windows device platforms, and requires the device to be marked as compliant.

Environment

Configuration

1. Conditional Access Starting Point

I confirmed the Conditional Access policies area before adding the new pilot policy. This provided a clean baseline for the user-created Conditional Access policy introduced in this lab.

Context: Capturing the starting point made the later policy creation evidence clear and avoided confusing the new pilot policy with pre-existing rules.

2. Pilot Policy Summary

I created CA001 - Require compliant device for pilot users and assigned it to GRP_Intune_Pilot. The policy targeted all Microsoft cloud resources and stayed in Report-only mode for controlled evaluation.

Context: Report-only mode allowed the policy impact to be measured through sign-in logs before enforcement was enabled.

3. Windows Platform Scope

I scoped the device platform condition to Windows only. This matched the current pilot estate, where both the compliant CL2 device and the unmanaged test device were Windows devices.

Context: Platform scoping kept the pilot aligned to the Windows endpoint rollout and avoided mixing mobile or non-Windows access controls into this lab.

4. Compliant Device Grant Control

I configured the grant control to require the device to be marked as compliant. I did not combine this with MFA, hybrid join, approved client app, app protection, or risk controls in this pilot lab.

Context: Using one grant control made the test result clear: access would depend on whether the device had a compliant state from Intune.

5. Report-only Policy Creation

I created the CA001 policy and confirmed it appeared in the Conditional Access policy list with a Report-only state.

Context: The policy was deliberately not enabled for enforcement. The lab validated expected impact without blocking access.

Validation

1. Compliant Device Sign-in

I signed in as Chloe Bennett from CL2, the cloud-native Microsoft Entra joined and Intune-compliant Windows pilot device.

Context: This generated a real Chloe Bennett sign-in event that could be evaluated against the Report-only Conditional Access policy.

2. Compliant Device Report-only Success

I reviewed the Chloe Bennett sign-in event in Microsoft Entra sign-in logs and confirmed that CA001 evaluated successfully for the compliant CL2 device. The grant controls were satisfied.

Context: The successful Report-only result proved that the Lab 17 compliance policy produced a usable access signal for Conditional Access.

3. Unmanaged Device Report-only Failure

I reviewed a Chloe Bennett sign-in from an unmanaged Windows home PC browser session and confirmed that CA001 would have failed access if the policy had been enforced. The device appeared as unknown and the compliant-device grant control was not satisfied.

Context: This confirmed the intended policy behaviour: managed and compliant Windows devices would satisfy the policy, while unmanaged Windows browser sessions would not.

Key Technical Outcomes

This lab demonstrated how Microsoft Entra Conditional Access can use Intune compliance as an access control signal. I configured a pilot policy, scoped it to a controlled group, limited it to Windows devices, used a compliant-device grant control, and validated the expected access impact through Report-only sign-in log evidence.