Conditional Access Problems

How to Setup Different Microsoft 365 Device Profiles for One Account

Bushra Parveen Oct 7, 2026 870 views

Question details

An organization wants to configure users to sign in across multiple devices but apply varying device-specific restrictions, such as limiting Microsoft Teams or OneDrive usage on lower-spec hardware.

How to Setup Different Microsoft 365 Device Profiles for One Account

Product: Microsoft 365
Device & OS: not provided
Scenario: Managing application deployment and resource usage for a single user account spanning across both high-spec and low-spec hardware devices.
Observed behavior: IT administrators need a way to apply different policies to the exact same user identity depending on the physical device they are currently logged into.

Before you start

Ensure you have an active Microsoft Intune subscription and possess Global Administrator or Intune Administrator privileges within your Microsoft Entra ID tenant.

Solution 1Recommended

Use Microsoft Intune and Conditional Access Policies

Leverage Microsoft Entra ID join alongside Microsoft Intune to deploy device-specific configurations and enforce AppLocker restrictions on low-spec hardware.

To apply varying configurations for a single user account across different devices, you must shift your focus from user-based targeting to device-based targeting.

By utilizing Microsoft Entra ID (formerly Azure AD) and Microsoft Intune, administrators can create filters and Conditional Access rules that check the physical device's properties before granting application access or deploying heavy software.

Join devices to Microsoft Entra ID

Ensure all devices (both high-end and low-spec) are joined to Microsoft Entra ID and enrolled in Microsoft Intune for centralized endpoint management.

Create device filters in Intune

Navigate to the Microsoft Endpoint Manager admin center, go to 'Tenant administration' > 'Filters', and create specific filters identifying your low-spec hardware (e.g., filtering by device model or manufacturer).

Deploy device-specific AppLocker policies

Create a new Configuration Profile in Intune for Endpoint protection. Configure AppLocker rules to block resource-heavy applications like the desktop versions of Teams or OneDrive. Assign this profile to the user group, but apply the 'Include' filter for your low-spec devices.

Configure Conditional Access rules

Open the Microsoft Entra admin center and navigate to 'Protection' > 'Conditional Access'. Create a new policy restricting access to certain cloud apps based on 'Device state' or 'Filter for devices' to ensure compliance across different hardware tiers.

Use Microsoft Intune and Conditional Access Policies

Additional Guidance: Since environment requirements can be highly specific, it is recommended to post your detailed hardware constraints in the Microsoft Intune Tech Community for tailored PowerShell scripts or policy templates.

Free Microsoft Office alternative

Optimize Low-Spec Devices with WPS Office

If managing complex Microsoft 365 configurations and AppLocker restrictions for older hardware is proving cumbersome, consider deploying WPS Office. It acts as an incredibly lightweight, all-in-one productivity suite that runs smoothly on low-spec machines without requiring intricate Conditional Access policies.

1. Download the lightweight installer: Visit the WPS Office website and download the free installation package suitable for your low-spec hardware.
2. Deploy across the organization: Install WPS Office on the target devices. It requires significantly less RAM and CPU than standard Office applications.
3. Open Microsoft files instantly: Users can immediately open, edit, and save their existing Microsoft Word, Excel, and PowerPoint documents without altering any formats.

Extremely lightweight and fast, ensuring smooth performance on low-spec hardware.Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Integrates Writer, Spreadsheet, and Presentation into a single tabbed application.Reduces IT overhead with simpler deployment compared to Microsoft 365.

microsoft office alternative - wps office

Frequently Asked Questions

Can I assign a Microsoft Intune policy to a user but only have it apply to a specific device?

Yes. You can assign the policy or app deployment to a User Group, and then use 'Filters' in Intune to include or exclude specific devices based on their properties (like OS version or device model).

How can I stop users from installing heavy applications on low-end hardware?

By using AppLocker policies deployed via Microsoft Intune or Group Policy, you can explicitly block the executables of heavy applications, forcing users to use the lighter web-based versions of those services.

Does Conditional Access require additional licensing?

Yes, implementing Conditional Access policies requires a Microsoft Entra ID P1 or P2 license (which is included in Microsoft 365 Business Premium, E3, and E5 plans).

Microsoft Office Security Issues