Posted in Endpoint Administrator, How To, Microsoft 365 Administrator, MS 365 Enterprise Administrator, MS 365 Modern Desktop Administrator, MS 365 Security Administrator

Step by Step: Creating a Microsoft Intune Conditional Access Policy

   October 9, 2023

Creating a Microsoft Intune Conditional Access Policy is a critical step in controlling access to corporate resources based on specific conditions. Here’s a step-by-step guide on how to create a basic Conditional Access Policy using the Microsoft Intune portal:

Prerequisites:

  • You should have an active Microsoft Intune subscription.
  • You need administrative access to the Microsoft Intune portal.

Step 1: Sign in to the Microsoft Intune Portal

  1. Go to the Microsoft Intune portal.
  2. Sign in with an account that has administrative access to your Intune subscription.

Step 2: Create a Conditional Access Policy

  1. In the left-hand menu, click on “Azure Active Directory.”
  2. Under the “Security” section, click on “Conditional Access.”
  3. On the “Conditional Access – Policies” page, click the “+ New policy” button to create a new Conditional Access Policy.

Step 3: Configure Policy Assignments

  1. In the “Name” field, give your policy a descriptive name. For example, “Require MFA for All Users.”
  2. In the “Assignments” section, specify which users or groups this policy should apply to. Click on “Users and groups,” then select the target users or groups. You can choose “All users” for a broad policy.

Step 4: Configure Access Controls

  1. In the “Access controls” section, click on “Grant” to define what should happen when the conditions are met. You can choose from options like “Block access,” “Require multi-factor authentication,” or “Allow access.”
  2. Select “Require multi-factor authentication” to enforce multi-factor authentication for the selected users or groups.

Step 5: Configure Conditions

  1. In the “Conditions” section, you can define the conditions that trigger this policy. Click on “Conditions.”
  2. You can set various conditions based on your requirements. For example:
  • Under “Client apps,” you can specify which apps are affected by this policy.
  • Under “Locations,” you can restrict access to certain locations or require specific locations.
  • Under “Device platforms,” you can target specific device platforms (e.g., iOS, Android).
  • Customize conditions based on your organization’s security needs.

Step 6: Configure Session Controls (Optional)

  1. In the “Session” section, you can set session control policies if needed, such as limiting session time or actions users can perform during their sessions.

Step 7: Review and Create

  1. Review your policy settings to ensure they align with your requirements.
  2. Click the “Create” button to create the Conditional Access Policy.

Step 8: Assign the Policy

  1. Once created, the policy will be listed under “Conditional Access – Policies.” By default, it’s not enabled. To enable the policy, click on it.
  2. In the policy details, toggle the switch to “On” to enable it.

Step 9: Testing

  1. Test the policy by signing in with a user account that falls under the policy’s assignment. You should be prompted for multi-factor authentication based on the conditions you’ve set.

Step 10: Monitoring and Refinement

  1. Continuously monitor the policy’s behavior and refine it as needed to meet your organization’s security requirements. You can adjust conditions, access controls, and assignments as necessary.

By following these steps, you can create a Microsoft Intune Conditional Access Policy to enhance the security of your organization’s resources by enforcing access control conditions such as multi-factor authentication based on user, device, and location criteria.

Share: TwitterFacebookPinterestLinkedin
Author: tonyhughes