There is a feature of Entra ID called Conditional Access policies that can require devices to have a state called “Compliant Device”. This is something that Intune can push to Entra so Conditional Access policies can enforce, but it is also possible to push a similar setting from a number of other MDM providers to Entra so you can enforce this requirement even if you do not use Intune for your mobile devices.
This is only available for iOS, Android and macOS devices, so not Windows devices, and it is configured in the Intune portal under Tenant Administration > Connectors and Tokens > Partner Compliance Management.
The way this feature works is a Conditional Access policy that requires a Compliant Device, but exempts the one application that is in your tenant that is created by your MDM for this feature. MDM’s that I have worked with that contain this feature include MobileIron (Ivanti EPMM) and SOTI. MobileIron has an application called “Mobileiron Device Compliance On-prem” (App ID: dee64bf0-b9cb-45f4-8357-e05f8955cf32) and SOTI has an application called “SOTI MobiControl Device Compliance” (App ID b509a4c3-7668-432e-91cc-f4c919d963bd).
This means that if the phone is a new phone, not registered in Entra ID and though compliant in its home MDM, this compliance status is not pushed to Entra because Entra knows nothing about the device, the user on the device can attempt to connect to an M365/Entra authenticated application and will be blocked due to the created conditional access rule – for example something like “CA802 – Require Compliant Device (SOTI) for Mobile Devices”. The end user on the device hits this CA policy and the grant setting of this policy is “Require Compliant Device”. It has to be this setting, as that triggers the phone, via its home MDM, to redirect to a page hosted by the home MDM and this page attempts to authenticate to Entra ID – but now it will attempt to authenticate as the application that is exempt from the CA policy.
Except it used to, and recently it broke, which is the purpose of this blog post! From the beginning of 2026 Microsoft have announced that Conditional Access rules would be changing from June 15th 2026. One of my clients found the above functionality stopped working Oct 13th 2026 and it is all to do with this Conditional Access change. The change is documented on the link above and involves changing the way Conditional Access rules that have application exemptions work. Before the change, an application exemption in Conditional Access also means that the Azure Active Directory application is allowed to bypass the conditional access rule – in this case be allowed to work from a non-compliant phone. Once the change is made in your tenant, this stops working. There are two fixes! The first is that your MDM vendor was on the ball and has updated their code and rolled out a fix. By the very nature of me writing this blog post, you can tell this did not happen for all MDM vendors. So the other fix, whilst waiting for the MDM application update, is to exempt the Windows Azure Active Directory application (App ID 00000002-0000-0000-c000-000000000000) from the Conditional Access rule as well. Once you do this device registration and compliance sync from the home MDM will work.
So how will you know that you need to make this change if you are reading this and not impacted by the Microsoft change in your tenant just yet – well Microsoft will publish Message Center post ID MC1506142 on the day they make the change in your tenant – or you just get the latest patches from your MDM vendor or you also exclude the Azure Active Directory application (for now) until your vendor fixes their code (as you don’t want to leave Windows Azure Active Directory open to basic OIDC queries – this is the reason why Microsoft closed down this security hole in the second half of 2026.
Photo by fauxels: https://www.pexels.com/photo/photo-of-people-standing-near-white-wall-3183180/
Leave a Reply