021: Access requirements

Implementation Effort: Medium to High – Requires alignment across identity, device, app, and data-protection teams.

User Impact: High – Access requirements directly affect who can sign in, from which devices, and under what management or protection conditions.

Overview

Access requirements are the policy decisions that determine what a user and device must satisfy before reaching organizational resources. In the Microsoft Intune and Microsoft Entra ecosystem, that can mean requiring a compliant device, requiring an approved client app, requiring app protection policy, or combining those conditions with strong authentication and risk signals. In Zero Trust, the right access requirement depends on resource sensitivity and device ownership rather than a single one-size-fits-all rule.

Implementation Guidance

1. Classify access scenarios first: internal users on corporate devices, BYOD mobile users, partners, frontline shared devices, and privileged administrators often need different requirements.
2. Require a compliant device for the highest-sensitivity workloads where the organization needs strong assurance of encryption, patching, health, and management state.
3. Use the Require app protection policy Conditional Access grant for supported mobile BYOD scenarios where full enrollment is not necessary or appropriate.
4. Align Conditional Access with the Intune policy model. A compliant-device requirement only works well when compliance policies are realistic, current, and monitored for exceptions.
5. Document exception paths and review them regularly. Long-lived access exceptions are one of the fastest ways to erode a Zero Trust design.
6. Test failure modes from the user point of view. Users and support staff should understand whether denial happened because of device compliance, app requirement, sign-in risk, or another control.

Reference

• Microsoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID — Explains grant controls such as requiring compliant devices, approved client apps, or app protection policies.
• Plan Your Microsoft Entra Conditional Access Deployment - Microsoft Entra ID — Covers how to plan, stage, and validate a Conditional Access rollout.
• Device compliance policies in Microsoft Intune - Microsoft Intune — Explains how to define compliance requirements and evaluate managed devices against them.
• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies in Intune.