Device Compliance

CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ

Require compliant device · Require hybrid Azure AD join

About this policy

The CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ policy requires Windows devices to be either compliant in Intune or hybrid joined before internal users can access cloud apps. The Intune service and Intune Enrollment app are excluded so new devices can still be enrolled. This is the policy that ties access to healthy, managed hardware on Windows, and it pairs naturally with the macOS equivalent. If a laptop falls out of compliance, access stops until the device is brought back in line.

Policy conditions

Users: Specific users
Apps: All cloud apps
Platforms: windows

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('bf40d6e7-542e-4e5a-94b0-f74860c3d0b4')",
  "@odata.editLink": "identity/conditionalAccess/policies('bf40d6e7-542e-4e5a-94b0-f74860c3d0b4')",
  "templateId": null,
  "displayName": "CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [
        "0000000a-0000-0000-c000-000000000000",
        "d4ebce55-015a-49b5-a083-c84d1797ae8c"
      ],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [
        "ceeac9b8-ddf5-48cb-afcb-e2ab8bfd1a57"
      ],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "a76676e6-d7f2-45ff-9973-d6a28680db56"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "platforms": {
      "@odata.type": "#microsoft.graph.conditionalAccessPlatforms",
      "includePlatforms@odata.type": "#Collection(microsoft.graph.conditionalAccessDevicePlatform)",
      "includePlatforms": [
        "windows"
      ],
      "excludePlatforms@odata.type": "#Collection(microsoft.graph.conditionalAccessDevicePlatform)",
      "excludePlatforms": []
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "compliantDevice",
      "domainJoinedDevice"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('bf40d6e7-542e-4e5a-94b0-f74860c3d0b4')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('bf40d6e7-542e-4e5a-94b0-f74860c3d0b4')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('bf40d6e7-542e-4e5a-94b0-f74860c3d0b4')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('bf40d6e7-542e-4e5a-94b0-f74860c3d0b4')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ policy requires Windows devices to be either compliant in Intune or hybrid joined before internal users can access cloud apps. The Intune service and Intune Enrollment app are excluded so new devices can still be enrolled. This is the policy that ties access to healthy, managed hardware on Windows, and it pairs naturally with the macOS equivalent. If a laptop falls out of compliance, access stops until the device is brought back in line."
}