Lab 4. Compliant device access

Time 25 minutes

Admin account lab-adminNN@aurnis.dev

User account lab-userNN@aurnis.dev

Roles Intune Administrator, Conditional Access Administrator

Scenario

Contoso's policy says: "Company documents may only be opened from a managed, compliant device." A correct user name, a correct password and even a passkey are not enough if the device itself is unknown. In this lab you compare two devices used by the same user: your own laptop, which the lab tenant has never seen, and LAB-PC-NN, which is joined to the tenant and managed by Microsoft Intune.

Objectives

• Find your lab desktop in Intune and read its compliance state
• Read the compliance policy that defines "compliant"
• Build a Conditional Access policy that requires a compliant device for SharePoint
• Prove the same user is blocked on an unmanaged laptop and allowed on the managed desktop

Task 1. Find your device in Intune

Admin window

1. Open a new tab and go to https://intune.microsoft.com. You are signed in already.
2. In the left menu select Devices.
3. Under By platform select Windows.
4. In the search box type LAB-PC-NN and select the device name.

Device overview in Intune. Compliance shows a green Compliant.

5. On the Overview page fill in what you see:

   Property	Value you see
   Managed by	Intune
   Compliance	Compliant
   Join type	Microsoft Entra joined
   Primary user	lab-userNN (or none for a pool-built device)
   OS version	Windows 11

Expected result

Compliance shows Compliant with a green tick. If it shows Not evaluated, tell the instructor; the device needs to check in once more.

I finished Task 1

Task 2. Read the compliance policy

Admin window

1. In the Intune left menu select Devices.
2. Under Manage devices select Compliance (in the older layout it is Compliance policies directly under Devices).
3. Select BASE-Windows-Compliance. Change nothing.
4. Select Properties in the policy's left menu.
5. Next to Compliance settings select Edit to read the rules, then Cancel:
   • Device Health: not needed for cloud desktops (BitLocker not required).
   • Device Properties: minimum OS version.
   • Microsoft Defender for Endpoint or Defender Antivirus: real-time protection required.
6. Next to Actions for noncompliance note Mark device noncompliant: Immediately.

The compliance policy: minimum OS version and Defender real-time protection, non-compliant immediately.

Expected result

You can name at least two checks a device must pass to be marked compliant, and you know that failing one marks it non-compliant straight away.

I finished Task 2

Task 3. Create the Conditional Access policy

Admin window

1. Switch to the Entra admin center tab (https://entra.microsoft.com).
2. Select Protection Conditional Access Policies, then + New policy.
3. In Name type CA-NN-Require-Compliant-Device.
4. Select Users, choose Select users and groups, tick Users and groups, search for Lab-Users-NN, tick it, select Select.
5. Select Target resources. Keep Resources (formerly cloud apps). On Include choose Select resources, select None, search SharePoint, tick Office 365 SharePoint Online, select Select.

Target resources: Office 365 SharePoint Online only.

6. Under Access controls select Grant. Keep Grant access and tick Require device to be marked as compliant. Select Select.

Grant: Require device to be marked as compliant.

7. Under Enable policy select On.

8. Check the summary, then select Create.

   Section	Must show
   Name	CA-NN-Require-Compliant-Device
   Users	1 group: Lab-Users-NN
   Target resources	1 resource: Office 365 SharePoint Online
   Grant	Require device to be marked as compliant
   Enable policy	On

Check before you select Create

Users must show only your group. Resource must be SharePoint Online only, so you can still reach the admin portals if something goes wrong.

Expected result

CA-NN-Require-Compliant-Device is listed with State: On.

Wait for propagation

Give the policy 1 to 2 minutes, and test from a fresh window so the browser does not reuse a token issued before the policy existed.

I finished Task 3

Task 4. Test from your own laptop (unmanaged)

User window

1. Sign out of the User window, close it, and open a fresh one.
2. Go to https://aurnistech.sharepoint.com/sites/Day1Lab.
3. Sign in as lab-userNN@aurnis.dev with your passkey.

Blocked from an unmanaged laptop. "More details" shows the device state Unregistered.

Expected result

A page titled You can't get there from here explains that the device must be managed and compliant. Select More details: Device state is Unregistered. Your laptop is unknown to the tenant, so the policy cannot trust it, no matter how strong the sign-in was.

4. Admin window Open Identity Monitoring & health Sign-in logs, select the newest row for your user, and open the Device info tab.

Expected result

Managed: No, Compliant: No, and on the Conditional Access tab your policy shows Failure with the control Require compliant device.

I finished Task 4

Task 5. Test from your lab desktop (managed)

User window Lab desktop

1. In the User window go to https://windows.cloud.microsoft and select Devices.
2. Select the tile LAB-PC-NN, then Connect.
3. If a dialog asks which local resources to share, leave the defaults and select Connect.
4. Windows prompts for credentials inside the session. Type the lab user password (the remote desktop sign-in uses the password, not the passkey). First start takes about two minutes.

Connecting to the lab desktop from Windows App. Use the lab user password here.

5. Inside the desktop, open Microsoft Edge from the taskbar.
6. Go to https://aurnistech.sharepoint.com/sites/Day1Lab. Edge on a joined device signs you in silently as lab-userNN; if it asks, sign in with the password.

Same user, same policy, managed device: the site opens.

Expected result

The Day1Lab site opens. In the Admin window the newest sign-in shows Managed: Yes, Compliant: Yes, Join type: Microsoft Entra joined, and your policy as Success.

7. Leave the desktop session open. You use it again in Lab 5.

I finished Task 5

Compare

	Your laptop	LAB-PC-NN
Registered in the tenant	No	Yes (Entra joined)
Managed by Intune	No	Yes
Compliant	No	Yes
SharePoint result	Blocked	Allowed

Conditional Access decision: IF user is valid AND authentication is strong AND device is compliant THEN allow. Any single "no" ends in a block.

Reflection

• Why is a user who passed phishing-resistant MFA still blocked on their own laptop?
• An attacker who has the user's credentials and somehow completed MFA but is using their own PC: which of email, Teams, SharePoint and Copilot could they reach under this policy, and what would you add to close the rest?
• How would you handle contractors who will never enrol a device? (Lab 5 offers a different answer than "make an exception".)

Checklist

• LAB-PC-NN found in Intune and Compliant
• Two compliance checks named
• CA-NN-Require-Compliant-Device created and On
• Blocked from your laptop, sign-in log shows Unregistered
• Allowed from the lab desktop, sign-in log shows Compliant: Yes

Next: Lab 5: Secure access with Microsoft Entra Suite.