Troubleshoot Intermittent Intune Company Portal Policies on Mac and iOS
Question details
Users are experiencing intermittent failures with Microsoft Intune Company Portal Conditional Access policies, allowing unmanaged devices to access organizational resources.
- Product
- Microsoft Intune / Company Portal
- Device & OS
- macOS and iOS
- Scenario
- Enforcing device management and compliance policies to restrict organizational data access strictly to managed macOS and iOS devices.
- Observed behavior
- Conditional Access policies intermittently fail, permitting unauthorized access from unmanaged devices. macOS compliance policies also appear ineffective, and recreating the policies only provides a temporary resolution.
Ensure you have Intune Administrator or Global Administrator privileges to review compliance logs, evaluate Conditional Access policies, and access Entra ID sign-in logs.
Audit Conditional Access Policies and Review Entra ID Sign-in Logs
Use this solution to identify the root cause of intermittent access bypasses. The issue requires backend Intune and Conditional Access troubleshooting rather than restarting a local macOS or iOS service.
Intermittent failures where unmanaged devices gain access are typically caused by overlapping Conditional Access policies, incorrect client app conditions, or misconfigured exclusions. Recreating a policy forces an immediate re-evaluation, which is why it serves as a temporary fix, but it does not address underlying configuration conflicts.
Navigate to the Microsoft Entra admin center. Go to 'Identity' > 'Monitoring & health' > 'Sign-in logs'. Filter by the affected user and select the specific sign-in event. Click the 'Conditional Access' tab to see which policies were applied, satisfied, or bypassed.
Open the Microsoft Intune admin center. Navigate to 'Devices' > 'macOS' or 'iOS/iPadOS'. Confirm that the devices in question are successfully enrolled and marked as 'Compliant'. Check the compliance policy assignment to ensure it applies to the correct user groups.
In the Intune admin center, go to 'Endpoint security' > 'Conditional access'. Review all active policies targeting the users. Ensure there are no conflicting policies granting 'Allow access' without requiring device compliance, and verify that exclusions are correctly defined.
If policies are perfectly configured but the issue persists, the backend service may require investigation. Post your specific configuration details to the Microsoft Intune enrollment community (Microsoft Q&A) or open a support ticket directly from the Intune admin center.
Manage Your Office Documents Seamlessly on Mac and iOS
While troubleshooting your Intune and Conditional Access policies, ensure your team stays highly productive across all their Apple devices. WPS Office is a free, lightweight, and incredibly powerful alternative to Microsoft Office that works flawlessly on macOS and iOS environments.
- 1. Download WPS Office: Visit the official WPS Office website or the Apple App Store to download the version specifically optimized for macOS or iOS.
- 2. Install and Launch: Follow the standard installation prompts on your Apple device and launch the application.
- 3. Open Existing Documents: Sign in to your account and instantly open your existing Microsoft Office files without worrying about formatting or layout errors.
Frequently Asked Questions
Why are unmanaged devices bypassing my Intune Conditional Access policies?
This usually occurs due to conflicting policies, incorrect client app conditions, or misconfigured group exclusions. Checking the Entra ID sign-in logs for the specific user event is the most effective way to identify exactly which policy incorrectly granted access.
Does restarting a local service on macOS fix Intune policy sync issues?
No, Intune policy enforcement is handled via cloud services and the Company Portal. Restarting a local service on a Mac will not resolve backend Conditional Access evaluations. You must force a sync from the Company Portal app instead.
How often do macOS and iOS devices check in with Intune?
Newly enrolled devices check in frequently for the first 15 minutes. Afterward, standard iOS and macOS devices generally synchronize with Intune servers every 6 to 8 hours by default.
Can I manually force a compliance policy sync on iOS and Mac?
Yes, users can open the Company Portal app on their respective devices, navigate to the device settings or preferences, and select the 'Check Status' or 'Sync' button to manually fetch the latest administrative policies.
