Conditional Access Problems

Fix Conditional Access Blocking a Compliant Device

Maira Mehtab Sep 29, 2026 869 views

Question details

Users are unable to access company resources because Conditional Access blocks them, even though their device is Microsoft Entra hybrid-joined and Intune-compliant.

How to Fix Conditional Access Blocking a Compliant Device

Product: Microsoft Entra ID / Intune
Device & OS: not provided
Scenario: Attempting to access cloud applications or open files online from an enterprise-managed, compliant device.
Observed behavior: The system denies access because the browser or application session fails to pass a valid device compliance signal, causing Conditional Access to treat the device as unmanaged.

Before you start

Ensure you have Microsoft Entra ID and Intune administrator privileges to review sign-in logs and compliance policies for the affected user.

Solution 1Recommended

Use Microsoft Edge or Install Required Browser Extensions

This is the most common fix. The browser must be able to pass the device compliance signal to Microsoft Entra. Using Microsoft Edge provides native support for this process.

When an application or browser cannot detect a valid device signal, Conditional Access assumes the device is noncompliant or unmanaged, even if it is fully compliant in Intune.

Switch to Microsoft Edge

Ask the affected user to open the online file or cloud resource using the Microsoft Edge browser, which natively passes device compliance signals to Entra ID.

Check Chrome Extensions

If the user must use Google Chrome, verify that the 'Windows 10 Accounts' extension is installed and enabled, as this is required to transmit compliance signals.

Verify Access

Refresh the application session or sign in again to check whether the Conditional Access block is lifted and access is restored.

Use Microsoft Edge or Install Required Browser Extensions

Signal Restored: Using a supported browser ensures the session correctly reports the device's managed status to the security policy.

Solution 2

Check Intune Compliance and Entra Sign-in Logs

Verify the actual compliance state of the device and identify exactly which Conditional Access policy is causing the block.

Free Microsoft Office alternative

Stay Productive While Troubleshooting with WPS Office

While resolving enterprise Conditional Access blocks, ensure your workflow isn't disrupted. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office for creating, editing, and sharing documents across all your personal and professional devices.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture that runs smoothly on Windows, Mac, and Linux.Familiar tabbed interface making migration seamless and intuitive.Completely free to use for essential office tasks, eliminating complex licensing hurdles.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Conditional Access treat my compliant device as unmanaged?

This happens when the browser or application you are using is unable to securely transmit the device compliance signal to Microsoft Entra ID. Without this signal, the Conditional Access policy defaults to treating the device as an unmanaged or noncompliant machine.

Do I need a specific browser to satisfy device compliance policies?

Yes. Microsoft Edge natively supports passing device compliance signals. If you are using third-party browsers like Google Chrome, you typically need to install a dedicated extension, such as the 'Windows 10 Accounts' extension, to allow the compliance signal to pass through.

How long does it take for Intune compliance status to sync with Microsoft Entra?

While Intune evaluates device compliance relatively quickly, it can sometimes take a few minutes for that status to replicate fully to Microsoft Entra ID. If a device just became compliant, wait 5 to 15 minutes and have the user try signing in again.

Microsoft Office Security Issues