Block Access on Personal Devices with Microsoft Conditional Access in 2026
Microsoft 365 makes it possible for employees to work from almost anywhere.
That flexibility is valuable, but it creates an important security question:
Should employees be able to access company email, Teams, SharePoint and OneDrive from any computer or phone they choose?
For many businesses, the answer should be no — or at least not without restrictions.
An employee may know the correct Microsoft 365 password and successfully complete MFA, but that does not mean the device they are using is safe.
A personal laptop could be missing updates, shared with family members, lack disk encryption or have no business-grade security monitoring. Company information downloaded to it may also remain there long after the employee leaves.
Microsoft Entra Conditional Access, combined with Microsoft Intune, can help organisations decide which users, devices and applications should be trusted before access to company resources is granted. Microsoft describes Conditional Access as its Zero Trust policy engine, using identity, device and application signals when evaluating access.
Personal, Unmanaged and Non-Compliant Devices Are Not the Same Thing
These terms are often used interchangeably, but they mean different things.
Personal device
A device owned by the employee.
A personal iPhone, for example, could still be enrolled in Microsoft Intune and managed according to company policy.
Unmanaged device
A device that is not currently under the organisation's device-management controls.
It might be personally owned or company owned.
Non-compliant device
A known device that has failed one or more security requirements established through Intune.
That could include requirements around encryption, operating-system versions, passwords, security configuration or other compliance settings. Microsoft Intune can report the device's compliance state to Entra ID, and Conditional Access can then use that result when making an access decision.
This distinction is important because simply trying to block anything marked “personal” is not always enough.
The stronger question is:
Is this a device the organisation knows, manages and considers sufficiently secure?
The Strongest Approach: Require Compliant Devices
One of the most straightforward Conditional Access designs is to require devices accessing selected company resources to be marked as compliant.
Microsoft's current 2026 guidance specifically documents the Conditional Access grant control:
Require device to be marked as compliant.
Microsoft also warns that an Intune compliance policy needs to exist first, and recommends confirming that compliant test devices are available before enforcing the Conditional Access policy.
A typical process works like this:
1. A company device is enrolled into Microsoft Intune.
2. Intune applies the organisation's security and configuration policies.
3. The device is evaluated against the compliance policy.
4. Intune reports the compliance state to Microsoft Entra ID.
5. Conditional Access checks that state when the user signs in.
6. If the required conditions are met, access can be granted.
An unknown or non-compliant device can therefore be blocked.
Compliance Alone Does Not Automatically Block Personal Devices
There is an important catch.
If employees are permitted to enrol their own devices into Intune, some personal devices may potentially become compliant.
That may be exactly what you want in a BYOD environment.
But if your objective is:
“Only company-owned devices should access Microsoft 365”
you also need to think about Intune enrolment restrictions.
Microsoft Intune allows administrators to prevent personally owned devices from enrolling. Microsoft's April 2026 guidance explicitly states that organisations can configure enrolment restrictions to block personal devices.
Combining the controls gives you a much clearer model:
Personal devices cannot enrol.
Unenrolled devices cannot satisfy the compliance requirement.
Conditional Access requires compliance.
Therefore unknown personal devices cannot gain normal access.
This is generally stronger than relying solely on the ownership field recorded against a device.
Do You Need to Block Personal Devices Completely?
Not necessarily.
There are roughly three practical models businesses can consider.
Option 1: Completely Block Unmanaged Devices
This is the strictest approach.
Users can access Microsoft 365 only from approved devices that meet the required security conditions.
This may be suitable where employees regularly handle:
Financial records.
Sensitive customer information.
Legal documents.
Confidential commercial information.
Regulated information.
Intellectual property.
The benefit is greater control over where business information is accessed and stored.
The disadvantage is reduced flexibility.
An employee who suddenly needs to access a document from a home computer may simply be unable to do so.
That may be completely acceptable — provided the business has planned for it.
Option 2: Allow Limited Web Access
Sometimes the business wants to allow access from an unmanaged computer without letting company files freely leave Microsoft 365.
SharePoint and OneDrive support controls for unmanaged devices that can block access completely or provide limited web-only access. These controls rely on Microsoft Entra Conditional Access.
Microsoft's current application-enforced restrictions can be used to limit access to SharePoint and OneDrive and can also apply restrictions involving Outlook web attachments and session behaviour on unmanaged devices. Microsoft recommends initially testing this sort of policy in Report-only mode.
This can create a useful middle ground.
A contractor or employee may be able to view information in the browser while restrictions reduce their ability to download or synchronise it onto an unmanaged machine.
But it is important not to oversell this.
If information is visible on a screen, a determined authorised user may still be able to photograph or manually reproduce it.
Limited access reduces risk.
It does not magically make information impossible to copy.
Option 3: Protect Company Data on Personal Phones
Mobile devices are different again.
Some organisations are perfectly comfortable with employees using their own phones, provided company information remains protected inside approved applications.
Microsoft Intune App Protection Policies can protect corporate data without requiring the entire device to be enrolled into mobile-device management. Microsoft calls out capabilities such as requiring a PIN, controlling copy and paste, restricting saving to personal locations and protecting data in supported applications.
This can allow a business to say:
“Yes, you can use Outlook on your personal phone.”
while still applying controls to the company's data inside Outlook.
That can be much more acceptable to employees than enrolling their entire personal phone into the company's device-management platform.
What Can App Protection Policies Do?
Depending on the device, platform and application, Intune App Protection Policies can help businesses:
Require a separate PIN.
Use biometrics for access.
Restrict copying corporate information into personal applications.
Prevent saving business data into personal storage.
Restrict printing.
Block access on rooted or jailbroken devices.
Apply operating-system requirements.
Remove company data without wiping personal information.
Microsoft confirms that App Protection Policies can work on employee-owned devices that are not enrolled in an MDM solution, although there are limitations compared with fully managed devices.
This makes them particularly useful for BYOD mobile scenarios.
What About Personal Windows Computers?
This is where businesses need to think carefully.
Allowing full Microsoft 365 desktop access from an unmanaged personal Windows computer can create opportunities for company data to be downloaded, synchronised or stored locally.
One option is to require compliant managed computers.
Another increasingly useful option is application protection for Windows, where supported. Microsoft currently documents Conditional Access policies that can require an App Protection Policy for scenarios such as BYOD using Microsoft Edge. Microsoft recommends starting in Report-only mode and carefully scoping the policy to unmanaged devices to avoid blocking legitimate managed access.
The correct design depends heavily on the business's workflow.
For some organisations:
No unmanaged Windows access is entirely appropriate.
For others:
Restricted browser access is a better compromise.
Don't Forget SharePoint, OneDrive and Teams
Microsoft 365 applications are interconnected.
Blocking SharePoint or OneDrive downloads can affect how files appear through other services such as Teams because Teams files are often stored in SharePoint or OneDrive.
Microsoft's unmanaged-device controls therefore need to be tested against the actual applications your employees use.
This is one reason Conditional Access should not be introduced with:
“Let's turn it on for everybody and see what happens.”
Test real workflows first.
That includes:
Outlook.
Teams.
SharePoint.
OneDrive.
Mobile applications.
Browser access.
Specialist applications.
Service accounts where relevant.
Use Report-Only Mode Before Enforcement
Conditional Access is extremely powerful.
A badly designed policy can also lock legitimate users — or administrators — out of Microsoft 365.
Microsoft recommends deploying new Conditional Access policies in Report-only mode first so administrators can see how the policies would evaluate sign-ins without actually enforcing the block.
A sensible rollout might therefore look like this:
1. Audit current device access.
2. Identify company and personal devices.
3. Establish Intune compliance policies.
4. Enrol approved devices.
5. Configure personal-device enrolment restrictions if required.
6. Build the Conditional Access policy.
7. Place it in Report-only mode.
8. Review sign-in logs.
9. Pilot with a small user group.
10. Communicate with employees.
11. Expand enforcement gradually.
That approach gives IT a chance to find unusual use cases before hundreds of employees suddenly lose access.
Protect Emergency Administrator Accounts
This is one of the most important Conditional Access safeguards.
Microsoft recommends maintaining emergency-access, sometimes called break-glass, administrator accounts and excluding them from Conditional Access policies that could block or restrict sign-in.
Why?
Imagine a device-compliance policy is accidentally configured incorrectly.
Normal administrators become blocked.
You now need an administrator to change the policy.
But every administrator is subject to the same broken policy.
That's a bad day.
Emergency accounts provide a carefully controlled route back into the tenant.
Microsoft recommends monitoring them and ensuring they remain usable in the situations for which they are intended.
This does not mean ordinary administrator accounts should be casually excluded from security policies.
Privileged users normally deserve stronger security, not weaker security.
Remember Existing Sessions
Enabling Conditional Access does not necessarily mean every existing session instantly disappears.
Microsoft 365 uses access and refresh tokens, so businesses tightening device controls should also think about existing authentication sessions and whether particular users or devices need sessions revoked.
That is especially relevant if you are introducing the policy because of a known security concern rather than as a routine improvement.
Review the sign-in logs and actual device access after deployment rather than assuming the policy has immediately removed every historical route into the environment.
Is Conditional Access Included in Microsoft 365?
Microsoft Entra Conditional Access requires Microsoft Entra ID P1 or an eligible subscription containing it.
Microsoft currently confirms that Microsoft 365 Business Premium includes Entra ID P1 and Conditional Access capabilities.
Intune and other features used alongside Conditional Access have their own licensing requirements.
This matters because a design involving:
Conditional Access.
Intune compliance.
App Protection Policies.
Device management.
may require more than simply having a Microsoft 365 Business Basic or Business Standard subscription.
Licensing should therefore be checked as part of the design rather than after the policies have been built.
Should Every Business Ban BYOD?
No.
A blanket ban is not automatically the most secure or practical answer.
There are organisations where providing every worker with a company device is straightforward.
There are others with:
Contractors.
Temporary workers.
Mobile workforces.
Personal-phone requirements.
External consultants.
Occasional remote users.
For those organisations, a controlled BYOD model may make more sense.
The goal should not be:
“Create the strictest policy possible.”
It should be:
“Give employees the access they genuinely need while reducing unnecessary exposure of company data.”
That could mean:
Company devices for regular employees.
Browser-only access for contractors.
Protected Outlook and Teams access on personal phones.
No downloads from unmanaged Windows computers.
Stricter controls for finance, administrators and sensitive departments.
Different users can have different requirements.
Conditional Access exists precisely because access does not have to be a simple choice between everything allowed and everything blocked.
The Better 2026 Approach
For many SMEs using Microsoft 365, a strong model is:
Manage company equipment through Intune.
Define meaningful device-compliance requirements.
Require compliant devices for full Microsoft 365 access.
Prevent unauthorised personal-device enrolment where company ownership is required.
Use restricted browser access where occasional unmanaged access is genuinely needed.
Use App Protection Policies for suitable BYOD mobile scenarios.
Protect administrators more strongly.
Keep emergency-access accounts available.
Test everything in Report-only mode before enforcement.
That gives employees flexibility without assuming that every device presenting a valid password should automatically receive full access to company information.
Protect Microsoft 365 Access With Hamilton Group
Hamilton Group can help businesses design and implement Microsoft 365 access controls around the way their employees actually work.
We can assist with Microsoft Entra Conditional Access, Microsoft Intune, device enrolment, compliance policies, BYOD restrictions, App Protection Policies, SharePoint and OneDrive access controls, MFA, passkeys, Microsoft 365 security and employee onboarding and offboarding.
We can also review which devices currently have access to your environment and identify whether personal or unmanaged devices are accessing company information without appropriate controls.
The objective is not to make remote working difficult.
It is to make sure trusted users are accessing business information from appropriately trusted devices and applications.
And when your team needs support, our aim is to make first contact on IT support requests within 15 minutes.
Call Hamilton Group on 0330 043 0069 or visit hgmssp.com to speak with one of our Microsoft 365 and cyber-security experts.