7.8 Device Compliance and Conditional Access

Device Compliance and Conditional Access Integration

By the end of this subsection, you will understand how Defender for Endpoint feeds device risk into Intune compliance, and how the "require compliant device" conditional access policy blocks AiTM token replay.

This is where Modules 1, 4, 5, and 7 converge. The conditional access gap that allowed the AiTM attack in Module 13 is closed here.

The integration chain

Step 1: Defender for Endpoint assesses device risk (low, medium, high) based on active threats and vulnerabilities.

Step 2: Intune compliance policy includes “Require device threat level: clear or low.” A device with medium or high risk becomes non-compliant.

Step 3: Entra ID conditional access policy requires a compliant device for Exchange Online and SharePoint.

Step 4: Non-compliant device (or unenrolled device) is blocked from accessing M365.

Why this blocks AiTM token replay

In the Module 13 scenario, the attacker replayed a stolen token from an unmanaged device. The token contained a valid MFA claim — conditional access requiring MFA was satisfied. But the attacker’s device was not enrolled in Intune. With a “require compliant device” policy:

• The attacker presents the stolen token to Exchange Online
• Conditional access evaluates: is the device compliant?
• The device is not enrolled in Intune — automatic non-compliance — blocked
• The MFA claim in the token is irrelevant — device compliance is the enforcement point

Intune compliance policy configuration

1. Navigate to Intune admin center -> Devices -> Compliance policies -> Create policy
2. Platform: Windows 10 and later
3. Compliance settings:
   • Device Health: Require device threat level = “Clear” or “Low”
   • System Security: Require BitLocker encryption = Yes
   • System Security: Require firewall = Yes
   • System Security: Require antivirus = Yes
   • System Security: Require antispyware = Yes
4. Actions for noncompliance: Mark noncompliant immediately (or 1-day grace period for rollout)
5. Assign to All Users or a pilot group

Conditional access policy configuration

1. Navigate to Entra ID -> Conditional Access -> Create new policy
2. Name: “Require compliant device for M365 apps”
3. Users: All users (exclude emergency access accounts)
4. Cloud apps: Exchange Online, SharePoint Online, Microsoft Teams
5. Conditions: All device platforms
6. Grant: Require device to be marked as compliant
7. Session: Sign-in frequency = 12 hours (forces periodic re-evaluation)
8. Enable policy (start with Report-only for 1 week, then enforce)

Verification query

1
2
3
4
5
6
7
8

SigninLogs
| where TimeGenerated > ago(7d)
| where ConditionalAccessStatus == "failure"
| mv-expand CAPolicy = parse_json(ConditionalAccessPolicies)
| where tostring(CAPolicy.displayName) has "compliant device"
| where tostring(CAPolicy.result) == "failure"
| summarize BlockedCount = count() by bin(TimeGenerated, 1d)
| sort by TimeGenerated asc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

SigninLogs
| where TimeGenerated > ago(7d)
| where ConditionalAccessStatus == "failure"
| mv-expand CAPolicy = parse_json(ConditionalAccessPolicies)
| where tostring(CAPolicy.displayName) has "compliant device"
| where tostring(CAPolicy.result) == "failure"
| extend OS = tostring(DeviceDetail.operatingSystem)
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize
    BlockCount = count(),
    Platforms = make_set(OS),
    Countries = make_set(Country),
    LastBlocked = max(TimeGenerated)
    by UserPrincipalName
| sort by BlockCount desc