# Office 365 Conditional Access

Office 365 Conditional Access Policy lets you ensure only Windows 10 or above devices enrolled with MDM can access Office 365 (and/or other apps that require Microsoft Azure sign in), while restricting access to unenrolled devices. You can do this by creating a **device-based Conditional Access policy** on the **Azure portal**.

> Granting access is restricted to Windows 10 or above devices, whereas all other device types can be blocked if required.

## Prerequisites

- The Microsoft Entra ID (formerly Azure Active Directory) account must be added as a **Work or School account** on all target devices where the policy will be applied.
- Each user leveraging the Conditional Access feature must be assigned a **[Microsoft Entra ID P1 Premium license (or higher)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview#license-requirements)**.
- Integration with MDM requires **Global Administrator** privileges in Microsoft Entra ID.

## Configure Conditional Access Policy

Configuring the Conditional Access policy consists of two steps:

- [Creating the policy on the Azure Portal](#create_azure)
- [Applying the policy on MDM](#apply_mdm)

### Creating the Conditional Access policy on the Azure Portal

- Login to [Azure Portal](https://portal.azure.com/#home) with your account credentials and navigate to **Entra ID (formerly Azure AD)** -> **Security** -> **Protect** -> **Conditional Access**.
- Click on **Create New Policy** to create the Conditional Access policy.
- Having provided a policy name, select **Users and Groups** present under **Assignments**.
  - Identify and choose the users and/or groups that this Conditional Access policy applies to.
  - Click on **Done**.

> Test the policy against a smaller group of users to make sure it works as expected.

- Under **Assignments**, select **Target resources**.
  - Select **Office 365** (includes [these apps](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#office-365-preview)), and/or identify other apps or services you want to protect using this Conditional Access policy.
  - Click on **Select**.
- Under **Assignments**, select **Conditions**.
  - Click on **Device Platforms** and identify the platforms you want this Conditional Access policy to apply to.
  - Click on **Select**.  
  **NOTE**: Microsoft Azure permits third-party MDM solutions to grant access only to enrolled Windows 10 or above devices, while blocking all other device platforms.
- Under **Access controls**, select **Grant**.
  - Configure the action to be taken based on the conditions you have set. Select **Grant access** and ensure **Require device to be marked as compliant** is checked.
- Under **Enable policy**, select **On** and click on **Create**.

> Right after enabling the Conditional Access policy on Azure, the selected users and groups cannot access Office 365 and other app(s) selected in the policy.

### Applying the policy on MDM

- On the console, navigate to **Device Mgmt** -> **Office 365** (under **Conditional Access**).
- If you haven't already integrated your **Entra ID (formerly Azure AD)**, click on **Integrate**.

![conditional-access-office365](https://www.manageengine.com/mobile-device-management/help/images/conditional-access-office365.png)

- A pop-up will appear requesting permissions for the ManageEngine application to allow MDM to fetch devices from Entra and update their compliance status. Select **Accept** to grant the permissions to proceed.
- Now, click on **Apply Policy** option present in the **Access Policy** view.

In the Device Details view, all enrolled Windows 10 or above devices will be marked compliant and users can login to their Azure accounts and access Office 365 (and/or other apps included while creating the policy), using these devices.

> Unenrolled devices will be marked **Non-compliant** and users cannot log in to Azure using such devices.

**NOTE**: For the Office 365 Conditional Access Policy to function in a streamlined and efficient manner, it is recommended to enroll Windows 10 or above devices using [Windows Azure Autopilot enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_windows_azure_enrollment.html?o365cap).

## Removing Conditional Access Policy

Removing the Conditional Access policy consists of two steps:

- [Stopping the policy on MDM](#stop_mdm)
- [Disabling the policy on the Azure portal](#disable_azure)

### Stopping the policy on MDM

- On the console, navigate to **Device Mgmt** -> **Office 365** (under **Conditional Access**).
- In the **Access Policy** view of the Office 365 Conditional Access policy, click on **Stop Policy**.

After stopping the policy, MDM will not grant access to devices enrolled henceforth. The devices to which you have already applied the policy will continue accessing Office 365 (and/or other apps included while creating the policy), if they are enrolled with MDM. Essentially, stopping the policy does not have an effect on devices to which you have already applied the Conditional Access policy.  
In order to completely remove the policy, follow the steps mentioned in the next section.

### Disabling the policy on the Azure portal

To entirely remove the policy, even from all the devices to which the policy has already been applied, you must disable the Conditional Access policy on the Azure portal. Follow these steps:

- Login to [Azure Portal](https://portal.azure.com/#home) with your account credentials and navigate to **Entra ID (formerly Azure AD)** -> **Security** -> **Conditional Access**.
- Find and select the policy that you want to remove from Azure.
- Under **Enable policy**, select **Off** and click on **Save**.

This will ensure the policy gets completely removed and all the previously selected users and groups will be able to access Office 365, and other apps included while creating the Conditional Access policy.

## FAQ

1. **Why is my O365 device not showing as "Enrolled" and "Compliant" in MDM?**  
   If the device is not marked as enrolled and compliant, follow these steps:
   - **Verify Azure Registration**: Ensure the device is registered in Azure (Entra account is added as a work or school account).
   - **Check Microsoft Certificate**: Make sure the certificate with the issuer name `MS-Organization-Access` appears in the MDM Inventory scan results (Location: MDM Inventory > Devices > [YOUR_DEVICE] > Certificates).
   - **Initiate O365 Sync**: Once the certificate is fetched, trigger an Office 365 sync.
   - **Check Enrollment & Compliance**: Verify if the device is marked as enrolled in MDM's O365 CA page. Check compliance status in Microsoft Entra ID > Devices > All Devices.
   - **Perform Another Sync**: After Entra marks the device as compliant, run another Office 365 sync to reflect the status in MDM.