Conditional Access Problems

How to Block Non-Work Computers with Conditional Access Policy

Khadija Khan Oct 1, 2026 869 views

Question details

The organization needs to restrict selected users so they can access cloud apps only from approved corporate devices, such as Microsoft Entra-joined or Entra-registered machines.

How to Block Non-Work Computers with Conditional Access Policy

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Configuring a Conditional Access policy to allow cloud app access exclusively from approved work computers while blocking personal or unauthorized devices.
Observed behavior: Current device filters relying on trust type or company ownership are misconfigured, leading to legitimate work computers being incorrectly blocked from accessing cloud applications.

Before you start

Before enforcing any new Conditional Access rules, verify that you have excluded at least one emergency access (break-glass) administrator account to prevent accidental tenant lockouts, and be prepared to test the configuration in Report-only mode.

Solution 1Recommended

Configure a Device Filter with Block Access Logic

Use this solution to accurately target approved devices using OR logic and block any devices that fall outside of those parameters.

To successfully block personal or non-work devices without affecting corporate machines, you must create a device filter that explicitly identifies approved devices (e.g., Entra-registered OR Entra-joined) and apply a Block control to everything else.

Target Users and Apps

Log in to the Microsoft Entra admin center, navigate to Protection > Conditional Access, and create a new policy. Assign the policy to the selected users (ensuring you exclude your emergency accounts) and target the specific cloud apps you wish to protect.

Configure the Device Filter

Under Conditions, select 'Filter for devices'. Turn it on and set the rule to 'Exclude' filtered devices from the policy. Build a rule to match your corporate computers, such as setting the 'deviceTrustType' attribute to equal 'ServerAD' OR 'AzureAD'.

Set the Block Control

Navigate to the Grant controls section and select 'Block access'. Because you excluded your corporate devices in the previous step, this block action will only apply to unapproved or non-work computers.

Test in Report-only Mode

At the bottom of the policy configuration screen, set 'Enable policy' to 'Report-only'. Save the policy and monitor the Microsoft Entra sign-in logs to ensure legitimate work computers are not being flagged before switching the policy to 'On'.

Configure a Device Filter with Block Access Logic

Important Logic Note: By setting the device filter to 'Exclude' your approved devices and the grant control to 'Block access', you effectively create a rule that says 'Block everything EXCEPT these approved devices'.

Free Microsoft Office alternative

Looking for a Lightweight and Free Office Suite?

While you manage your organization's device access and cloud security policies, you might also be seeking a cost-effective, high-performance office software solution for your users. WPS Office offers exceptional functionality and format compatibility without the heavy licensing fees of Microsoft 365.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Software: Run the installer and follow the on-screen prompts to securely deploy WPS Office on your computer.
3. Start Creating: Open WPS Writer, Spreadsheet, or Presentation to immediately start working with full Microsoft Office format compatibility.

Seamless compatibility with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight deployment that works perfectly on both corporate-managed and personal devices, simplifying access policy management.Completely free to use with an intuitive interface that requires zero user retraining.Built-in PDF editing and cloud collaboration tools for modern business workflows.

microsoft office alternative - wps office

Frequently Asked Questions

Why is my Conditional Access policy blocking legitimate work computers?

This commonly occurs when device filters are configured with 'AND' logic instead of 'OR' logic for different device trust types, or when the policy is set to 'Include' approved devices alongside a 'Block' grant control, which inadvertently blocks the good devices.

What is the purpose of Report-only mode in Conditional Access?

Report-only mode allows administrators to evaluate the impact of a Conditional Access policy in real-time. It logs what the policy outcome would have been during a user's sign-in without actually enforcing the block or grant, ensuring corporate workflows aren't disrupted during testing.

How do I ensure IT admins don't get locked out by a block policy?

Always configure a 'break-glass' or emergency access administrator account that is explicitly added to the 'Exclude' list under the Users assignment of your Conditional Access policy. This ensures at least one account can always access the tenant to fix misconfigurations.

Microsoft Office Security Issues