Conditional Access for Exchange Email in Configuration Manager

In the Configuration Manager console, click Assets and Compliance.

Expand Compliance Settings, expand Conditional Access, and then click Exchange Online.

On the Home tab, in the Links group, click Configure Conditional Access Policy in the Intune Console. You might need to provide the user name and password of the account used to connect Configuration Manager with any global administrator for the Intune service.

The Intune admin console opens.

In the Microsoft Intune administration console, click Policy > Conditional Access > Exchange Online Policy.

On the Exchange Online Policy page, select Enable conditional access policy for Exchange Online. If you check this, the device must be compliant. If this is not checked then conditional access is not applied.

Under Outlook and other apps using modern authentication, you can choose to restrict access only to devices that are compliant for each platform. Windows devices must either be domain joined, or be enrolled in Intune and compliant.

Using Exchange Online with Configuration Manager and Intune, you can not only manage mobile devices with conditional access, but also desktop computers as well. PCs must either be domain joined, or be enrolled in Intune and compliant. You can set the following requirements:

- **Devices must be domain joined or compliant.** PCs must either be domain joined or compliant with the policies set in Intune. If a PC does not meet either of these requirements, the user is prompted to enroll the device with Intune.

- **Devices must be domain joined.** PCs must be domain joined to access Exchange Online. If a PC is not domain joined, access to email is blocked and the user is prompted to contact the IT admin.

- **Devices must be compliant.** PCs must be enrolled in Intune and compliant. If a PC is not enrolled, a message with instructions on how to enroll is displayed.

Under Outlook web access (OWA), you can choose to allow access to Exchange Online only through the supported browsers: Safari (iOS), and Chrome (Android). Access from other browsers will be blocked. The same platform restrictions you selected for Application access for Outlook also apply here.

On Android devices, users must enable the browser access. To do this the end-user must enable the “Enable Browser Access” option on the enrolled device as follows:

1. Launch the Company Portal app.

2. Go to the Settings page from the triple dots (…) or the hardware menu button.

3. Press the Enable Browser Access button.

4. In the Chrome browser, sign out of Office 365 and restart Chrome.

On iOS and Android platforms, To identify the device that is used to access the service, Azure Active Directory will issue a Transport layer security ( TLS) certificate to the device. The device displays the certificate with a prompt to the end-user to select the certificate as seen in the screen shots below. The end-user must select this certificate before they can continue to use the browser.

iOS

Android

Under Exchange ActiveSync mail apps, you can choose to block email from accessing Exchange Online if the device is noncompliant, and select whether to allow or block access to email when Intune cannot manage the device.

Under Targeted Groups, select the Active Directory security groups of users to which the policy will apply.

Under Exempted Groups, select the Active Directory security groups of users that are exempt from this policy. If a user is in both the targeted and exempted groups, they will be exempt from the policy and will have access to their email.

When you are finished, click Save.

In the Configuration Manager console, click Assets and Compliance.

Expand Compliance Settings, expand Conditional Access, and then click On-Premises Exchange.

On the Home tab, in the On-Premises Exchange group, click Configure Conditional Access Policy.

On the General page of the Configure Conditional Access Policy Wizard, specify your Intune tenant domain name. This is the suffix of the tenant ID you used to set up the Intune connector. For example, if the tenant ID you used is admin@corpemail.contoso.com, then the domain name you enter on this page of the wizard is corpemail.contoso.com.

If you have not setup a notification email account when you set up the Exchange connector, you will see a warning on this page, and the Next button is disabled. Before you can proceed, you must first configure the notification email settings in the Exchange Connector and then come back to the Configure Conditional Access Policy Wizard to complete the process.

Click Next.

On the Targeted Collections page, add one or more user collections. In order to access Exchange, users in these collections must enroll their devices with Intune and also be compliant with any compliance policies you deployed.

Click Next.

On the Exempted Collections page, add any user collections that you want to be exempt from the conditional access policy. Users in these groups, do not need to enroll their devices with Intune and do not need to be compliant with any deployed compliance policies in order to access Exchange.

If a user appears in both the targeted and exempted lists, they will be exempt from the conditional access policy.

Click Next.

On the Edit User Notification page, configure the email that Intune sends to users with instructions about how to unblock their device (in addition to the email that Exchange sends).

You can edit the default message and use HTML tags to format how the text appears. You can also send an email in advance to your employees notifying them of the upcoming changes and providing them with instructions about enrolling their devices.

Click Next.

On the Summary page, review your settings, and then complete the wizard.