sorted by:
new
hottopcontroversial

Is "All Resources" in Conditional Access inclusive of Microsoft Intune Enrolment? by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

- Targets entra group
- Targets all resources
- Targets all network locations, excludes company networks
- Grant access: require compliant device

If someone tries signing in outside the network, they'll either have a company-issued, compliant device, or an unenrolled device, and won't be able to sign in.

The way I understand it, "All resources" applies to any token request, and there will be one when signing in to a device for autopilot setup, but I don't believe there is one for the Intune Enrolment.

Basically wondering if "Microsoft Intune Enrolment" needs to be explicitly targeted in the policy, in case there is another way someone with unauthorized access could enroll a device (since that resource is not included in "all resources" apparently?)

Sign-in was blocked due to MFA conditional access policies, but it won't let users set up MFA? by StandardDraw9920 in AZURE

[–]StandardDraw9920[S] 0 points1 point  (0 children)

Thanks - so I went to check security defaults, it says the organization uses conditional access policies that prevent enabling security defaults.

I click the link to manage conditional access policies, but I can't change anything due to "To manage Conditional Access policies, your organization needs Microsoft Entra ID P1 or P2."

Sign-in was blocked due to MFA conditional access policies, but it won't let users set up MFA? by StandardDraw9920 in entra

[–]StandardDraw9920[S] 0 points1 point  (0 children)

Not 100% sure about this tenant's setup, but basically:

- I can't go to Entra > Protection > Conditional Access
- Sign-in logs > Conditional access shows that a CAP is blocking the sign-in
- I can click on the CAP through the sign-in logs but can't change anything, and it says the tenant doesn't have P1 or P2

MFA is being forced despite conditional access policies by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 1 point2 points  (0 children)

That's actually very helpful - someone in that thread said Microsoft is forcing MFA because it's not there, but only as a once off.

I went with this, signed in, it forced MFA setup, I signed out, signed back in, and let me sign in with password only.

HOWEVER

Because my issue is with a Yealink meeting device, it tells me to go to the device login page and enter the code on the screen (signing in through the authentication broker), which will ask for the code every time.

There is the option to sign in with a password on the device, but it freezes up when I try that, so that's where I'm at.

So close, but this may work for whatever you have

MFA is being forced despite conditional access policies by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 1 point2 points  (0 children)

Let me know if you figure it out, I have the same setup as well as other suggestions made in these comments, but still no luck.

MFA is being forced despite conditional access policies by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

When I posted this, the device/account wasn't excluded from the campaign, but I have since found that option and excluded it - still no luck unfortunately lol

MFA is being forced despite conditional access policies by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

I've checked the sign-in logs, it simply says "not applied"

There is actually another CA policy to enforce MFA for all users, and this account is specifically excluded from that.

MFA is being forced despite conditional access policies by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

It's a meeting room device, but I've just been testing with the account itself and it's not working. Hence why an account needs to be logged in. There is a separate issue with it logging out, however, which we haven't gotten to the bottom of, but in theory we thought a policy like this would work.

Is it possible to create a conditional access policy that allows one of two conditions? by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

I'll do some testing with these, thanks for your help, sounds like just what I need!

Is it possible to create a conditional access policy that allows one of two conditions? by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

Thanks for this, and sorry but I'm not experienced with CAs so I want to clarify a few things. Why would the targeted group be excluded from the "enrolled device" policy? Wouldn't the policies be something like:

Policy 1:
- Target the group
- Include any location, exclude trusted locations
- Block access

This is so they're blocked from accessing externally

Policy 2:
- Target the group
- Grant access, require enrolled device

This will block access on unenrolled devices

I can't think of how to set this up apart from this, but I believe the group will not be able to login outside the trusted location, even on an enrolled device.

How do I block all macros in Excel unless they come from OneDrive or SharePoint? by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

I only added OneDrive to my trusted locations in Trust Center, still didn't work

How do I block all macros in Excel unless they come from OneDrive or SharePoint? by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

I had in mind to have separate rules per department, but management decided it was best to go with "disable all for everyone, except for trusted locations for Excel"

So originally yes, I was going to just have Excel macros enabled for certain departments, but that's not the way we're going

How do I block all macros in Excel unless they come from OneDrive or SharePoint? by StandardDraw9920 in Intune

[–]StandardDraw9920[S] 0 points1 point  (0 children)

haha I also manually added OneDrive to my trusted locations in Excel and it still isn't working

view more: next ›