#Modern Workplace

  While working on a customer's Azure tenant, I came across an issue that I hadn't seen before. I was configuring the Intune tenant to provision Windows 11 devices using Autopilot. As part of the configuration, OneDrive for Business was also included to manage and secure user data. However, after provisioning a device, I soon started seeing issues with OneDrive failing to sync. I will only see a pop-up window displaying the message ' Sorry, OneDrive can't add your folder right now. Please contact support .'. Not really helpful. There was nothing in the Entra sign-in logs, so ruled out conditional access policies as the root cause. I also had the relevant licenses assigned so I ruled that out as well. Then I recalled that there was something similar in relation to Outlook mailbox device management setting which could interfere with Intune device management policies. Something that I also blogged about which you can check out over here . Not really like for like, but ...

Source:Microsoft With the help of Microsoft Intune, organizations can use the device states returned from the enrolled devices to Entra ID to identify whether these devices meet specific policy compliance requirements and accordingly enforce controls to grant or block access to corporate resources. With device states, once the user has successfully authenticated, a Primary Refresh Token (PRT) containing both user and device claims is issued. With conditional access policies requiring either a device-based control or a multifactor authentication control in place, the policy requirement can be met through its device state using PRT without attempting MFA. This is because when a PRT requests access to an application, its device, session, and MFA claims are trusted by Microsoft Entra ID. The PRT is valid for 14 days and is continuously renewed as long as the user actively uses the device, providing users a resilient experience. With the currently available device states, Microsoft recommen...

Recently, a customer asked me if there was a way to restrict access to corporate data on Azure AD joined Windows 11 devices only. They didn't want the existing conditional access policy to apply which required a Hybrid joined device to be compliant as they were moving away from Hybrid join identity for good. This intrigued me as there is actually no direct setting in the conditional access conditions & grant controls which covers Windows 11 & Azure AD joined states explicitly. So how do you grant access just to Azure AD joined Windows 11 devices? The answer is by using Filter for devices and specific grant controls.  In case you are unfamiliar with Filter for devices feature then you should know that Azure AD uses device authentication to evaluate device filter rules. For a device that is unregistered with Azure AD, all device properties are considered as null values and the device attributes cannot be determined since the device does not exist in the directory. Therefore,...