How to Block Microsoft 365 Apps Using Conditional Access Policy

Start by signing into the Microsoft Entra admin center with your administrative credentials. This is where you'll create and manage all Conditional Access policies.

Open your web browser and navigate to https://entra.microsoft.com. Sign in using an account with Global Administrator, Security Administrator, or Conditional Access Administrator permissions.

Once logged in, navigate to the Conditional Access section:

1. In the left navigation pane, expand Protection
2. Click on Conditional Access

Alternatively, you can access this from the Microsoft 365 admin center by going to Admin centers > Identity > Conditional Access.

Now you'll create a new policy specifically designed to block Microsoft 365 access from unmanaged devices. This policy will serve as your primary defense against unauthorized device access.

In the Conditional Access dashboard:

1. Click New policy at the top of the page
2. In the Name field, enter a descriptive name: Block M365 Apps from Unmanaged Devices

The policy name should be clear and descriptive so other administrators understand its purpose at a glance.

Leave the policy in the default state for now - we'll configure all settings before enabling it.

Configure which users and groups this policy will apply to. For maximum security, you'll typically want to apply this to all users while excluding emergency access accounts.

In the Assignments section, click on Users and groups:

1. Under Include, select All users
2. Under Exclude, click Select excluded users and groups
3. Add your emergency access accounts (break-glass accounts) and any service accounts that need to bypass this policy
4. Click Select to confirm your exclusions

Emergency access accounts are critical for maintaining access during policy conflicts or misconfigurations.

For initial testing, consider creating a pilot group with a few test users instead of applying to all users immediately.

Configure which cloud applications this policy will protect. You'll target the Microsoft 365 suite of applications that users typically access from various devices.

In the Assignments section, click on Target resources:

1. Ensure Cloud apps is selected
2. Under Include, choose Select apps
3. Click Select to open the application picker
4. Search for and select Office 365 (this covers the entire Microsoft 365 suite)
5. Alternatively, you can select individual apps like Microsoft Teams, SharePoint Online, Exchange Online, etc.
6. Click Select to confirm your choices

The Office 365 selection is recommended as it provides comprehensive coverage of all Microsoft 365 applications with a single selection.

Set up the conditions that will trigger this policy. You'll configure device platforms and client applications to specifically target unmanaged device scenarios.

In the Conditions section, configure the following:

Device platforms:

1. Click on Device platforms and set Configure to Yes
2. Under Include, select Any device or choose specific platforms like Windows, iOS, Android

Client apps:

1. Click on Client apps and set Configure to Yes
2. Check Mobile apps and desktop clients to target native applications
3. Optionally uncheck Browser if you want to allow web access from unmanaged devices
4. Check Legacy authentication clients to block older protocols like IMAP, POP, and SMTP

Legacy authentication is commonly used by unmanaged devices and represents a significant security risk.

Set up device compliance requirements to distinguish between managed and unmanaged devices. This step requires Microsoft Intune integration for device management.

In the Conditions section, click on Filter for devices:

1. Set Configure to Yes
2. Select Exclude filtered devices
3. Click + Add filter
4. Create a filter rule: device.isCompliant -eq True
5. Name the filter: Compliant Devices

If you don't have Intune, you can use device state conditions:

1. Click on Device state and set Configure to Yes
2. Under Exclude, select Device Hybrid Azure AD joined and Device marked as compliant

This configuration ensures that only unmanaged (non-compliant, non-domain-joined) devices are blocked.

Configure the policy action to block access when the conditions are met. This is the core security control that will prevent unmanaged devices from accessing Microsoft 365.

In the Access controls section, click on Grant:

1. Select Block access
2. Leave all other options unchecked
3. Click Select to confirm

The block access control is absolute - when triggered, users will be completely denied access to the targeted applications.

You can also configure a custom block message:

1. Scroll down to find Customize block message
2. Enter a user-friendly message: Access denied: Please use a company-managed device to access Microsoft 365 applications. Contact IT support for assistance.

Before activating the policy, enable report-only mode to test its impact without affecting users. This crucial step prevents accidental lockouts and allows you to validate the policy logic.

At the bottom of the policy configuration page:

1. Under Enable policy, select Report-only
2. Click Create to save the policy

Report-only mode will log what would happen if the policy were active without actually blocking access.

Monitor the policy for at least 24-48 hours:

1. Go to Monitoring > Sign-in logs in the Entra admin center
2. Filter by your policy name to see triggered events
3. Review the Conditional Access tab in sign-in details

Look for entries showing "Report-only" status to understand which users and devices would be affected.

After validating the policy in report-only mode, activate it to begin blocking unmanaged device access. Continue monitoring to ensure it works as expected.

To activate the policy:

1. Return to Protection > Conditional Access
2. Click on your policy name to edit it
3. Change Enable policy from Report-only to On
4. Click Save

The policy is now active and will block access from unmanaged devices.

Monitor the policy effectiveness:

1. Check Monitoring > Sign-in logs regularly
2. Look for "Failure" entries with "Conditional Access" as the failure reason
3. Use the Insights and reporting section for policy impact analysis

You can also use PowerShell to export policy details for documentation:

Install-Module Microsoft.Graph
Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.DisplayName -eq "Block M365 Apps from Unmanaged Devices"}

Create a supplementary policy specifically targeting legacy authentication, which is commonly used by unmanaged devices and represents a significant security risk.

Create a new policy for legacy authentication blocking:

1. Click New policy again
2. Name it: Block Legacy Authentication for All Apps
3. Under Users and groups, select All users (exclude emergency accounts)
4. Under Target resources, select All cloud apps

Configure the legacy authentication conditions:

1. In Conditions > Client apps, set Configure to Yes
2. Uncheck all options except Legacy authentication clients
3. Under Access controls > Grant, select Block access

This policy specifically targets older authentication protocols like:

• IMAP/POP3 email clients
• SMTP authentication
• Legacy Office clients
• PowerShell modules using basic authentication

Test this policy in report-only mode first, then activate it following the same process as the main policy.