Confirmation Required: Conditional Access, Device Compliance and Company Portal App Downloads

Question

Confirmation Required: Conditional Access, Device Compliance and Company Portal App Downloads

Daniel Bracho 0

Hi Microsoft Support Team,

I hope you are doing well.

Could you please confirm whether, in an environment where Microsoft Entra Conditional Access requires a device to be marked as compliant, a device that Intune reports as Non-compliant due to BitLocker/encryption method requirements and Firewall configuration can be prevented from accessing the services required to download corporate applications through Company Portal?

More specifically, I would like to confirm the following scenario:

Device encryption / Firewall configuration not compliant - Intune reports the device as Non-compliant - Conditional Access evaluates the device as not compliant - Conditional Access blocks access to protected corporate resources/services -- The user is therefore unable to download corporate applications through Company Portal.

I understand that Intune can still manage and deploy applications to a device even when it is Non-compliant. However, my question is specifically whether Conditional Access can prevent the authentication/access required by Company Portal to download applications when the device does not satisfy the compliance requirement.

Could you please confirm whether this is the expected behavior and, if possible, provide the relevant Microsoft documentation supporting this scenario?

This clarification is important because there appears to be some uncertainty internally about whether the inability to download corporate applications is related to the device's Non-compliant status and the Conditional Access policy.

Thank you for your assistance.

Best regards,

Daniel

Rahul Jindal 11,721 Reputation points

2026-08-12T08:31:22.6666667+00:00

I am not sure if the AI generated response answered your question, but as far as I know, the CA policy is going to block user's authentication on the Company Portal app if the device falls out of compliance. That said, the device will still be manageable through Intune.

2 answers

Your answer

Rahul Jindal 11,721 Reputation points

2026-08-12T08:31:22.6666667+00:00

I am not sure if the AI generated response answered your question, but as far as I know, the CA policy is going to block user's authentication on the Company Portal app if the device falls out of compliance. That said, the device will still be manageable through Intune.

Answer 1

Hi @Daniel Bracho

Short answer: you're right, and it's not a workaround gap, it's by design.

Conditional Access grant controls (including "require compliant device") gate access to resources at Entra ID sign-in / token issuance. App deployment through Intune runs over a separate channel entirely, the MDM management connection authenticated by the device's Intune certificate, not an Entra token. CA has no hook into that channel. That's also why Intune can keep pushing remediation to a non-compliant device at all; if CA could block the management channel, a device could never get itself back to compliant.

Doc worth citing: Require device compliance with Conditional Access confirms the compliant-device grant control doesn't block Intune enrollment, for the same reason, enrollment and management have to stay reachable regardless of compliance state. App delivery rides the same channel.

For scoping app assignments to compliant devices only, there's no native attribute for it. Neither Intune assignment filters nor Entra dynamic group rules expose compliance state, checked both against the current reference docs, it's just not in the property list either place. The practical fix people use: a scheduled job (Logic App or Azure Automation) queries complianceState per device from /deviceManagement/managedDevices in Graph, writes Compliant/NonCompliant into one of the device's Entra extensionAttribute fields, then you build your dynamic group off that attribute (device.extensionAttribute1 -eq "Compliant") and assign the app to the group. It's polling-based so there's some lag, but it's the only way to get compliance into either targeting surface today.

Answer 2

Yes. That behavior is expected when access to the required service is protected by a Conditional Access policy that uses Require device to be marked as compliant.

Supported flow:

A device enrolls in Intune and registers in Microsoft Entra ID.
Intune reports the device compliance state to Microsoft Entra ID.
If the device is Non-compliant because it fails compliance settings such as encryption or firewall requirements, Conditional Access evaluates it as not compliant.
When a Conditional Access policy requires the device to be marked as compliant, access to protected organizational resources is blocked.

Microsoft documentation states that when Conditional Access uses device compliance status, Conditional Access uses that compliance status to determine whether to grant or block access to organizational resources. It also states that when a device is not compliant and a Conditional Access policy applies, the device is blocked.

For the Company Portal part of the scenario, the documented exception is narrower than a general app download allowance:

Require device to be marked as compliant does not block Intune enrollment.
It also does not block access to the Microsoft Intune Web Company Portal application.

So the correct interpretation is:

A noncompliant device can still be allowed through the specific exceptions for enrollment and the Microsoft Intune Web Company Portal application.
But if downloading or installing a corporate app through Company Portal requires access to other protected corporate resources or services that are covered by Conditional Access, those accesses can be blocked because the device is noncompliant.

This means the statement "noncompliant device = always unable to download apps from Company Portal" is too broad based on the available documentation. The supported conclusion is:

Conditional Access can block access required by Company Portal app scenarios when that access depends on protected resources and the device is noncompliant.
Conditional Access does not block Intune enrollment or access to the Microsoft Intune Web Company Portal application solely because the policy requires device compliance.

If the internal question is whether noncompliance from encryption/firewall settings can be the reason users cannot access protected services needed during app acquisition, the answer is yes.