Microsoft F1 license + Business basic Conditional access policy

Hey Amaan, thanks for the question—this one trips people up often. In short, there’s no built-in “web vs app” carve-out in Conditional Access per se, but you do need the right Intune/device-management license to get a compliance signal on browsers. Here’s what’s happening:

1. Entra ID P1 (part of both F1 and Business Basic) gives you the Conditional Access engine, but
2. Intune/device compliance checks require an Intune-enabled subscription (for example Microsoft 365 Business Premium or a standalone Intune/EMS E3)
3. Business Basic does NOT include device management—even though it bundles AAD P1, it doesn’t give you the Intune service that actually marks a device compliant.

What that means:

• If your user only has Business Basic (and F1 only brings AAD P1), there is no Intune license to enroll their personal PC/mobile device.

• Without enrollment, the device can never report “compliant,” so the CA policy can’t block the browser sign-in (the compliance grant control simply never fires).

• In contrast, standard users with a proper Intune-enabled license have their device marked compliant, so your “block if non-compliant” rule works as expected.

Recommendation:

• Assign Microsoft 365 Business Premium (or Intune/EMS E3) to your Business Basic users so they can enroll devices.

• Verify your CA policy’s assignments include the Browser under “Client apps” (or target the Office 365/All cloud apps if you want to cover web).

• Under Grant controls select “Require device to be marked compliant.”

Reference list:

• Conditional Access licensing (requires AAD P1 + Intune for device compliance): https://learn.microsoft.com/azure/active-directory/conditional-access/licensing
• Configure and deploy conditional access (license requirements section): https://learn.microsoft.com/azure/active-directory/conditional-access/overview#license-requirements
• Microsoft Entra licensing (which SKU includes Intune/device management): https://learn.microsoft.com/entra/fundamentals/licensing#microsoft-entra-id-protection

Hi Shubham Sharma,

Microsoft 365 F1 license do include Intune Plan 1 please take a look at this https://www.microsoft.com/en-us/microsoft-365/enterprise/f1#:~:text=Without%20Teams-,Microsoft%20365%20F1,-%242.25

Amaan Ansari

Thank you for your reply.

1. Yes — Microsoft 365 F1 does include Intune Plan 1

Microsoft confirms that Intune Plan 1 is included in several Microsoft 365 bundles, including F1.

Intune Plan 1 provides device management (MDM/MAM) and compliance capabilities.

https://www.microsoft.com/en-us/security/business/microsoft-intune-pricing

https://learn.microsoft.com/en-us/intune/fundamentals/licensing

2. Conditional Access “Require compliant device” depends on Intune enrollment

Microsoft clearly states:

Conditional Access uses device compliance signals from Intune to make decisions.

Without a compliance policy and enrolled device, the policy will not function as intended.

Devices must be enrolled in Intune, otherwise compliance cannot be evaluated.

This is the critical point:

Conditional Access does NOT block access by itself — it relies on Intune to provide a compliance verdict.

https://learn.microsoft.com/en-us/intune/device-security/conditional-access-integration/overview

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance

https://tenantwizards.com/guides/intune-compliance-policies-setup-guide-2026/

3. Why browser access still works (root cause)

There is no license-based exemption for web login. The real reason is:

If the device is not enrolled in Intune, it has no compliance state

When CA evaluates:

It checks for compliance

If no compliance signal exists (unenrolled browser session), behavior depends on how the policy is scoped

Additionally:

Conditional Access + Intune is designed to block or require enrollment for unmanaged devices when correctly configured (all apps + browsers targeted + no fallback).

https://learn.microsoft.com/en-us/intune/device-security/conditional-access-integration/overview

If users can still access via browser, it typically means:

Misconfiguration scenario: -

Policy does not fully target browser-based access, OR

Alternative grant controls exist (e.g., OR conditions like MFA), OR

App enforcement gaps (e.g., not targeting “All cloud apps”), OR

Using app protection policies instead of device compliance, OR

Devices are treated as unknown → not explicitly blocked

Root Cause

This is not a licensing limitation of Business Basic or F1.

F1 already includes Intune Plan 1

Conditional Access works the same for web and apps

The issue is:

The device is not enrolled in Intune, so no compliance signal exists, and the CA policy is not strictly enforcing a block for browser-based access.

Below are the recommended Fix: -

1. Ensure device compliance pipeline is complete

Create Intune compliance policies

Enroll devices (Company Portal / MDM enrollment required)

Verify device shows Compliant

2. Fix Conditional Access policy configuration

Make sure:

Assignments

Users: Target affected users

Cloud apps: All cloud apps (recommended)

Conditions → Client apps

Include:

Browser

Mobile apps and desktop clients

Grant

Require device to be marked as compliant

Avoid OR conditions (like MFA OR compliant)

3. Optional hardening

From CA design guidance:

Block unknown/unsupported device platforms

Disable browser persistence if needed

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance

Microsoft 365 F1 does include Intune Plan 1, so there is no licensing limitation; however, Conditional Access “Require compliant device” only works when devices are enrolled in Intune and have a compliance state—if users can still access via browser, it indicates the devices are not enrolled or the CA policy is not fully targeting browser access or enforcing compliance strictly.

• This is not primarily a Business Basic licensing limitation.
• Since the user also has an F1 license, they should already have the required Intune + Entra ID P1 entitlement for Conditional Access.
• The reason users can still access services through a web browser on personal devices is that “Require compliant device” does not always fully block browser-based access by itself.
• Conditional Access evaluates browser sessions differently from desktop/mobile apps, and unmanaged browsers may still be allowed unless additional controls are configured.

To fully block personal/unmanaged devices, ensure your Conditional Access policy also properly targets:

• Browser access
• Modern authentication clients
• Supported browsers
• And optionally enforce:
  • Require compliant device
    • Require Hybrid Azure AD joined device
      • Session controls / limited web access

So the issue is most likely policy configuration for web access, not the Business Basic license.

• This is not primarily a Business Basic licensing limitation.
• Since the user also has an F1 license, they should already have the required Intune + Entra ID P1 entitlement for Conditional Access.
• The reason users can still access services through a web browser on personal devices is that “Require compliant device” does not always fully block browser-based access by itself.
• Conditional Access evaluates browser sessions differently from desktop/mobile apps, and unmanaged browsers may still be allowed unless additional controls are configured.

To fully block personal/unmanaged devices, ensure your Conditional Access policy also properly targets:

• Browser access
• Modern authentication clients
• Supported browsers
• And optionally enforce:
  • Require compliant device
    • Require Hybrid Azure AD joined device
      • Session controls / limited web access

So the issue is most likely policy configuration for web access, not the Business Basic license.

Hello Amaan Ansari,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having a Conditional Access enforcement issue for Microsoft 365 web access from personal or non-compliant devices.

This behavior is not caused by a special licensing limitation for browser sign-ins. In this case, Microsoft 365 F1 is the relevant license because it includes Microsoft Entra ID P1 and Microsoft Intune Plan 1, which are the required foundations for Conditional Access and device compliance. By contrast, Microsoft 365 Business Basic includes Microsoft Entra ID Free and Basic Mobility and Security, not Entra ID P1 or full Intune Plan 1. - https://learn.microsoft.com/en-us/entra/fundamentals/licensing, https://www.microsoft.com/en-us/security/business/microsoft-intune-pricing, https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-security-overview?view=o365-worldwide

The best resolution I can recommend is to:

• Keep the your F1 license in place as the entitlement that covers Entra ID P1 and Intune Plan 1 for this enforcement scenario. As listed in the links above.
• Create and assign real Intune compliance policies for every device platform that must be evaluated. - https://learn.microsoft.com/en-us/intune/device-security/compliance/overview, https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance
• Change Mark devices with no compliance policy assigned as to Not compliant in Intune tenant settings so unmanaged or unassigned devices do not pass the policy by default.
• Verify that the Conditional Access policy targets the correct cloud resources and includes Browser traffic, with the grant control Require device to be marked as compliant. - https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions
• Test with a supported browser that can pass device identity correctly, such as Edge signed in with the work profile, or Chrome/Firefox configured according to Microsoft guidance. - https://learn.microsoft.com/en-us/deployedge/ms-edge-security-conditional-access
• If the business requirement is to block personal devices completely, add a second Conditional Access block policy using Filter for devices so unregistered or personally owned devices are also denied. - https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices, https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions

Once these controls are configured correctly, access from unmanaged or non-compliant devices can be blocked consistently, and the sign-in logs can then confirm whether any remaining gap is caused by policy scope, compliance status, or browser/device identity flow. For more reading and steps, use the associated links above.

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.