DET-MS-CA-001 Conditional Access Identity config Severity: Informational
Entra Conditional Access — block unmanaged-device access to corporate apps
Conditional Access policy denying access to corporate apps from unmanaged devices, reducing the BYO bypass path for Shadow AI usage.
Rule
# Microsoft Entra Conditional Access — Policy: 'Block unmanaged-device access to corp apps'
#
# Assignments:
# - Users: All users (exclude break-glass accounts)
# - Cloud apps: All cloud apps (or scope to data-sensitive apps for phased rollout)
# - Conditions:
# - Device platforms: All
# - Client apps: All
# - Device state: Exclude Hybrid Azure AD joined OR compliant
#
# Access controls:
# - Grant: Block access
#
# Rationale: a managed device is the policy-enforcement endpoint for Endpoint DLP, MDE,
# and most Shadow AI prevention. Unmanaged-device access undermines all of it.# Microsoft Entra Conditional Access — Policy: 'Block unmanaged-device access to corp apps' # # Assignments: # - Users: All users (exclude break-glass accounts) # - Cloud apps: All cloud apps (or scope to data-sensitive apps for phased rollout) # - Conditions: # - Device platforms: All # - Client apps: All # - Device state: Exclude Hybrid Azure AD joined OR compliant # # Access controls: # - Grant: Block access # # Rationale: a managed device is the policy-enforcement endpoint for Endpoint DLP, MDE, # and most Shadow AI prevention. Unmanaged-device access undermines all of it.
How it works
Foundational identity policy. Doesn't directly detect Shadow AI, but eliminates the most common bypass: 'I'll just open my personal laptop and paste it into ChatGPT there.' If the user can't pull corporate context onto that laptop, they can't paste it into a consumer AI tool.
Required data sources
- Microsoft Entra ID P1 or higher
- Intune (for device compliance state)
Prerequisites
- Entra ID P1+ licensed
- Devices enrolled in Intune (or Hybrid Azure AD joined)
- Break-glass accounts created and excluded
Expected volume
Initial spike of legitimate-user blocks during phased rollout. Drops to near zero after enrollment.
False-positive guidance
Phase rollout by user group; provide enrollment self-service.
Tuning steps
- Start with report-only mode for 2 weeks.
- Phase rollout: pilot group → low-risk users → enterprise-wide.
- Pair with self-service device enrollment + clear escalation path.
Framework mappings
- NIST AI RMF: GOVERN-4.1
- ISO/IEC 42001: 8.2
- NIST CSF: PR.AC-1, PR.AC-3