Compliant macOS device still blocked by Conditional Access from accessing SharePoint

Ivanya Amadea Clara Sianipar 0 Reputation points
2026-09-17T17:04:36.0966667+00:00

Description:

I'm trying to access my company's SharePoint site from a macOS device (MacBook Pro, M2, 2022) that I've enrolled as BYOD via Microsoft Intune Company Portal.

Current status:

  • Company Portal shows the device as "In compliance"
  • Device Management (System Settings) confirms it's supervised/managed, with Management Profile, Firewall Profile, and Passcode Profile all installed
  • Signed in with my correct work account

Problem: Every time I try to open SharePoint, I'm redirected to the enrollment page (portal.manage.microsoft.com/ConditionalAccess/Enrollment) asking me to enroll the device again — as if it isn't recognized as compliant, even though Company Portal confirms it is.

Troubleshooting already done:

  • Restarted the Mac
  • Tested in Safari, Microsoft Edge, and Google Chrome — identical result in all three
  • Checked Safari Extensions for a missing SSO extension — none found/needed
  • Manually refreshed device status in Company Portal
  • Confirmed Jamf is not involved (not installed on this device)
  • Waited over an hour since compliance was confirmed — issue persists

My organization doesn't have an in-house IT/Intune admin, so I can't check the Conditional Access policy or Entra ID device registration directly. Could someone help me understand: is this a known sync delay between Intune and Entra ID, or does this need a compliance re-check from the admin side? Any guidance is appreciated.Description:

I'm trying to access my company's SharePoint site from a macOS device (MacBook Pro, M2, 2022) that I've enrolled as BYOD via Microsoft Intune Company Portal.

Current status:

  • Company Portal shows the device as "In compliance"
  • Device Management (System Settings) confirms it's supervised/managed, with Management Profile, Firewall Profile, and Passcode Profile all installed
  • Signed in with my correct work account

Problem:
Every time I try to open SharePoint, I'm redirected to the enrollment page (portal.manage.microsoft.com/ConditionalAccess/Enrollment) asking me to enroll the device again — as if it isn't recognized as compliant, even though Company Portal confirms it is.

Troubleshooting already done:

  • Restarted the Mac
  • Tested in Safari, Microsoft Edge, and Google Chrome — identical result in all three
  • Checked Safari Extensions for a missing SSO extension — none found/needed
  • Manually refreshed device status in Company Portal
  • Confirmed Jamf is not involved (not installed on this device)
  • Waited over an hour since compliance was confirmed — issue persists

My organization doesn't have an in-house IT/Intune admin, so I can't check the Conditional Access policy or Entra ID device registration directly. Could someone help me understand: is this a known sync delay between Intune and Entra ID, or does this need a compliance re-check from the admin side? Any guidance is appreciated.

Microsoft Security | Intune | Enrollment

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. takeig 0 Reputation points
    2026-09-18T00:59:31.9466667+00:00

    If the device is shown as compliant in Intune but is still redirected to a device registration page when accessing SharePoint Online, I would first check whether the device information is being passed correctly from macOS to Microsoft Entra ID during sign-in.

    When Conditional Access requires the device to be marked as compliant, being compliant in Intune alone is not sufficient. Microsoft Entra ID must also be able to identify the device during the authentication flow. If the device ID is not provided correctly, Conditional Access may treat the device as unregistered or unmanaged even though Intune reports it as compliant.

    On macOS, I would also verify that the Microsoft Enterprise SSO plug-in is properly configured and deployed through MDM. The Enterprise SSO plug-in can participate in device registration and device-based Conditional Access scenarios.

    I would also check the Microsoft Entra sign-in logs for the affected sign-in and confirm:

    whether a Device ID is present

    whether "Is compliant" is shown as Yes

    which Conditional Access policy and grant control caused the failure

    This should help determine whether the issue is related to the Intune compliance state itself or to the device information not being passed correctly during authentication.

    References:

    Microsoft Enterprise SSO plug-in for Apple devices: https://learn.microsoft.com/en-us/entra/identity-platform/apple-sso-plugin

    Conditional Access conditions: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.