Skip to main content

021: Access requirements

Implementation Effort: Medium to High – Requires alignment across identity, device, app, and data-protection teams.

User Impact: High – Access requirements directly affect who can sign in, from which devices, and under what management or protection conditions.

Overview​

Access requirements are the policy decisions that determine what a user and device must satisfy before reaching organizational resources. In the Microsoft Intune and Microsoft Entra ecosystem, that can mean requiring a compliant device, requiring an approved client app, requiring app protection policy, or combining those conditions with strong authentication and risk signals. In Zero Trust, the right access requirement depends on resource sensitivity and device ownership rather than a single one-size-fits-all rule.

Implementation Guidance​

  1. Classify access scenarios first: internal users on corporate devices, BYOD mobile users, partners, frontline shared devices, and privileged administrators often need different requirements.
  2. Require a compliant device for the highest-sensitivity workloads where the organization needs strong assurance of encryption, patching, health, and management state.
  3. Use the Require app protection policy Conditional Access grant for supported mobile BYOD scenarios where full enrollment is not necessary or appropriate.
  4. Align Conditional Access with the Intune policy model. A compliant-device requirement only works well when compliance policies are realistic, current, and monitored for exceptions.
  5. Document exception paths and review them regularly. Long-lived access exceptions are one of the fastest ways to erode a Zero Trust design.
  6. Test failure modes from the user point of view. Users and support staff should understand whether denial happened because of device compliance, app requirement, sign-in risk, or another control.

Reference​