046: MAM Compliance and Conditional Access

Implementation Effort: Medium to High
User Impact: Medium

Overview

A modern page on MAM, compliance, and Conditional Access should explain which control is being applied at which layer:

• App protection protects the data inside the app.
• Device compliance evaluates whether an enrolled device meets policy.
• Conditional Access determines whether access to the cloud resource is granted.

Zero Trust requires deliberate use of all three, not loose or interchangeable terminology.

Implementation Guidance

1. Document whether each user population is unmanaged/BYOD, enrolled corporate-owned, or high-sensitivity managed.
2. Use app protection-based access for supported unmanaged mobile scenarios.
3. Use compliant-device requirements when the business needs full device trust, device configuration enforcement, or broader endpoint control.
4. Align Conditional Access policies to the chosen model and avoid overlapping rules that confuse troubleshooting.
5. Validate policy behavior with sign-in logs and user tests, not just by reading the configuration.
6. Publish exception handling and support runbooks.
7. Review the design whenever Microsoft updates Conditional Access behavior for mobile apps.

If administrators understand which problem each layer solves, they are much less likely to create contradictory or overly broad access rules.

Video Walkthrough

Reference

• Conditional Access - Require approved app or app protection policy - Microsoft Entra ID — Explains the Conditional Access grant controls that require approved apps or Intune app protection policies.
• How to Require Device Compliance with Conditional Access - Microsoft Entra ID — Shows how to require compliant devices with Conditional Access by combining Entra and Intune policies.
• App Protection Policies Overview - Microsoft Intune — Overview of Intune app protection policies and how they safeguard organizational data in managed apps.
• Device compliance policies in Microsoft Intune - Microsoft Intune — Overview of Intune device compliance policies, compliance settings, and resulting device states.