How to allow only personal devices that belong to users in a Entra group to be able to access corp. info

Lee Fleming 0 Reputation points
2026-06-01T20:12:13.1433333+00:00

So, we have corporate mobile devices and users approved for BYOD mobile devices. I have groups setup for both cases. The question is, how do we keep any other mobile devices from accessing corporate data (Outlook, Teams, etc..)?

Microsoft Security | Intune | Enrollment
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-06-01T20:12:40.35+00:00

    Use a combination of Intune app protection, device compliance, and Conditional Access, scoped to the Entra groups that represent approved users/devices.

    A concise pattern:

    1. Decide how to treat personal vs corporate devices
      • For corporate-owned devices, require Intune enrollment and compliance.
      • For BYOD/personal devices, either:
        • Allow optional enrollment and manage them as devices, or
        • Keep them unenrolled and manage only the apps with Intune app protection policies.
    2. Use Intune app protection policies for all mobile apps
      • Create Intune app protection policies for Outlook, Teams, and other Microsoft 365 apps.
      • Assign these policies only to users in the corporate devices group and BYOD-approved group.
      • These policies protect corporate data on both organization and personal devices and can be used even when devices are not enrolled.
    3. Require compliant or managed devices via Conditional Access
      • In Microsoft Entra Conditional Access, create policies for cloud apps like Exchange Online and Microsoft Teams:
        • Condition: Target the mobile apps and desktop clients.
        • Users: Include only the Entra groups for corporate devices and BYOD-approved users.
        • Grant controls:
          • For corporate devices: require device to be marked as compliant (Intune-enrolled, compliant devices only).
          • For BYOD devices: require either compliant device or app protection policy (depending on whether BYOD must be enrolled or can stay unenrolled).
      • This ensures that only devices that meet compliance or app-protection conditions, and that belong to users in the approved groups, can access corporate data.
    4. Block all other devices/users by omission
      • Any user not in the approved Entra groups, or any device that is not compliant / not using an app with Intune app protection, will fail the Conditional Access checks and be blocked from accessing Outlook, Teams, etc.
    5. Optional: enforce compliant-only access for higher security
      • For stricter Zero Trust posture, use a Conditional Access rule to require compliant PCs and mobile devices for corporate data, while still allowing BYOD where appropriate by combining with app protection policies.
    6. Plan and communicate BYOD handling
      • As part of Intune planning, explicitly decide whether personal devices must enroll or can remain unenrolled with app protection only.
      • Use Terms and conditions with Conditional Access so that when users accept, a device record is added to Microsoft Entra ID, making the device a known entity and allowing tracking of access.

    This combination of Intune app protection, device compliance, and Conditional Access—scoped to specific Entra groups—prevents any unapproved mobile devices from accessing corporate data while still supporting both corporate and approved BYOD scenarios.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.