Conditional Access for Exchange Online: Require Compliant Devices and Approved Apps Without Locking Out Users

Finance users want to check Exchange Online mail from personal iPhones. Security wants to stop mail apps that can’t enforce pin or data loss prevention. A blanket block on mobile kills productivity. A targeted Conditional Access policy scoped to Exchange Online can require an Intune-compliant device and an approved app, and let everything else through.

The problem with all-or-nothing mobile access

Exchange Online is accessible from Outlook desktop, Outlook on the web, Outlook mobile, and many third-party clients using IMAP/POP3. When access is left open, mail can be read on unmanaged devices with no app protection, no encryption, and no wipe capability.

Blocking Exchange Online entirely is not an option. The practical compromise is to enforce controls only for the risky surface: unmanaged devices and unapproved mail apps, while allowing managed, compliant access to continue.

How the policy works

Conditional Access evaluates sign-ins and can require grant controls before access is allowed. For Exchange Online you can combine:

• Cloud apps: Microsoft Exchange Online, and optionally Office 365 Exchange Online.
• Users and groups: a pilot group first, then broader production groups. Exclude break-glass accounts.
• Conditions: Client apps = mobile apps and all browsers, or a specific platform filter. Device filter for managed devices.
• Grant controls: Require device to be marked compliant in Microsoft Intune, and require approved client app. App protection is enforced via Azure AD app protection policies.

When both requirements are present, users on non-compliant devices or with unsupported mail clients see a remediation prompt to enroll the device or install the approved Outlook app. Legacy protocols like IMAP and POP3 are blocked when modern authentication is enforced, which reduces credential-stuffing risk.

Policy evaluation order matters. If a conflicting policy grants access, the grant wins. Place the restrictive Exchange Online policy with a higher priority than permissive policies, or use explicit exclusions to avoid accidental bypass.

Worked example: policy settings for Outlook mobile

Create the policy in Entra ID > Security > Conditional Access > New policy.

Name: Exchange Online - Require compliant device and approved app

• Assignments: Include target user group, e.g., Finance-All. Exclude BreakGlass-Admins.
• Cloud apps: Microsoft Exchange.
• Conditions: Client apps = Mobile apps. Platform = iOS and Android. Device state = Any.
• Grant: Require device to be marked as compliant. Require approved client app. Access granted.
• Session: Sign-in frequency can be left at default for this example.

App protection is configured separately in Intune > Apps > App protection policies. Create an app protection policy for Outlook, set Data protection to require app pin and restrict copy/paste, and assign to the same user group. The Conditional Access grant control references the approved client app; the app protection policy enforces the behavior inside Outlook mobile.

Licensing note: device compliance requires Microsoft Intune, typically via Microsoft 365 E5 or EMS E5. App protection and Conditional Access require Azure AD Premium P1 or P2. Missing licenses cause policy evaluation to fail silently.

Trade-offs and limits to plan for

Enforcing modern authentication and app protection will break older third-party mail clients that do not support OAuth. Identify those workloads and either migrate them or add an exclusion group.

Conditional Access changes can take up to 30 minutes to propagate. Test with a pilot user before broad rollout to avoid unexpected lockouts.

Device compliance is only meaningful if Intune enrollment and compliance policies are in place. A device marked compliant must meet OS version, encryption, and security baseline requirements you define.

Verification approach: create a test user with a non-compliant device and attempt sign-in to Outlook on the web or Outlook mobile. Expect a block with a remediation message about device compliance. Enroll the device, achieve compliance, and retry. In Entra ID > Monitoring > Sign-ins, filter by user and application Microsoft Exchange. Check the Conditional Access result and the grant controls applied to confirm success or failure.

Start narrow, validate with sign-in logs, then expand scope. That keeps Exchange Online usable while raising the bar for unmanaged access.