Intune compliance policies decide whether a device meets your requirements. Conditional Access is what actually acts on that at sign-in — the two are meant to be used together.

How They Work Together

A compliance policy in Intune marks each device as compliant or noncompliant. A Conditional Access policy in Microsoft Entra ID then checks that status at sign-in time and decides whether to allow access, require multi-factor authentication, or block the sign-in entirely.

Steps to Create a Basic Policy

1. Go to the Microsoft Entra admin center > Protection > Conditional Access > Create new policy.
2. Name it clearly, e.g. "Require Compliant Device – All Apps."
3. Under Users, choose who the policy applies to (start with a small test group before rolling out company-wide).
4. Under Target resources, choose which apps this applies to (e.g. all cloud apps, or specifically Exchange Online/Office 365).
5. Under Grant, select Require device to be marked as compliant.
6. Set the policy to Report-only first so you can see who would be blocked before actually enforcing it, then switch it to On once you've confirmed it behaves as expected.

Common Questions

Why did a user get blocked even though their device looks fine?

Check the device's compliance status directly in Intune first — a device that seems fine to the user may be failing a specific rule (e.g. an outdated OS version) that isn't obvious from the outside.

Should we start with Report-only mode?

Yes, always test new Conditional Access policies in Report-only mode first — it shows you exactly who would have been blocked without actually blocking anyone, which prevents accidentally locking out your whole company on a Friday afternoon.