Conditional Access iOS Android Access Control CAD017-Selected: Grant iOS and Android access for All users when Modern Auth Clients and AppProPol or Compliant

This Policy in One Line

This Conditional Access policy allows mobile access from iOS and Android devices only when the device is compliant or when the application used for access meets approved application protection requirements.

What This Conditional Access Policy Does

Conditional Access iOS Android access control evaluates mobile sign-ins from supported mobile platforms and determines whether the device or application meets defined security criteria. The policy focuses specifically on mobile application access using modern authentication clients, which are the authentication methods used by most modern Microsoft 365 and Entra-connected applications.

When a user signs in from a mobile device, Conditional Access evaluates the platform of the device and the client application type used for authentication. If the sign-in originates from an iOS or Android platform using modern mobile clients, the policy evaluates whether one of two conditions is satisfied.

Access can proceed if the device itself is compliant with the organization’s device management policies. Alternatively, access can also proceed if the mobile application meets approved application protection requirements. The policy uses a flexible decision model where either condition can satisfy the access requirement.

This design allows organizations to protect corporate resources while supporting both fully managed devices and protected application environments.

Who the Policy Applies To

The policy applies to users who are members of a specific user group defined in the Conditional Access configuration. By targeting a group instead of the entire tenant population, the policy can be applied in a controlled and structured manner.

Organizations often use security groups to represent populations such as employees, pilot users, or device-enabled workforces. By attaching the policy to a group, administrators can control which users are subject to mobile access requirements without impacting other populations.

Certain groups are excluded from the policy. In Conditional Access design, exclusion groups are commonly used to support controlled exception management. Security teams often maintain these groups to allow approved users to bypass a policy temporarily during troubleshooting, device migration, or staged rollouts.

External users and guest identities are excluded from the scope of the policy. This design choice ensures that the mobile access requirements described here apply only to internal identities within the tenant environment.

What Apps and Services the Policy Protects

Information not present in the policy.

Platforms, Devices, and Client Apps in Scope

The Conditional Access configuration specifically targets mobile device platforms. Only two platforms fall within the scope of the policy: Android and iOS.

By restricting evaluation to these platforms, the policy focuses entirely on mobile device access scenarios. Desktop operating systems and other device platforms are outside the scope of this configuration and would typically be governed by separate Conditional Access policies.

The policy also evaluates the type of client application used during authentication. It targets mobile applications and desktop clients that use modern authentication. Modern authentication clients rely on secure token-based identity flows supported by Microsoft Entra ID.

This design ensures that the policy evaluates access when modern mobile applications authenticate against Microsoft cloud services. It allows the identity platform to enforce device or application-based security requirements during the sign-in process.

How Access Is Decided

Conditional Access iOS Android access control determines access by evaluating two possible conditions during authentication. The policy uses a flexible decision model where satisfying either condition allows the sign-in to proceed.

The first possible condition is device compliance. If the mobile device meets the organization’s compliance requirements, the identity platform considers the device trustworthy enough to access protected resources. Compliance requirements are typically enforced through mobile device management platforms.

The second possible condition evaluates the application used for access. If the mobile application is recognized as a compliant or approved application, the sign-in can proceed even if the device itself is not fully managed.

Because the policy allows either of these conditions to satisfy the requirement, it supports multiple mobile security strategies simultaneously. Organizations can protect access using device compliance, application protection policies, or a combination of both.

What the User Experience Looks Like During Sign-In

From the user’s perspective, the Conditional Access iOS Android access control policy operates quietly in the background during authentication. When a user signs in from a mobile device, Microsoft Entra ID begins evaluating the device platform and the authentication client.

If the device already meets the organization’s compliance requirements, the user typically experiences a seamless sign-in. The identity platform recognizes that the device satisfies the policy conditions and allows the authentication to proceed.

If the device is not compliant but the user accesses resources through an approved mobile application, the application-level protection condition can satisfy the policy requirement. In this case, the application environment itself becomes the trusted boundary for protecting corporate data.

If neither condition is satisfied, the identity platform prevents the sign-in until the required device or application conditions are met.

Why This Policy Matters for Security and the Business

Mobile devices have become one of the most common entry points for accessing corporate services. Without proper controls, unmanaged devices can easily become a path for data exposure or unauthorized access.

Conditional Access iOS Android access control addresses this challenge by shifting the decision from device ownership to device trust. Instead of simply allowing mobile access, the identity platform evaluates whether the device or application environment meets security expectations.

This approach allows organizations to support a wide range of mobile work scenarios. Employees using fully managed corporate devices can access resources through device compliance. At the same time, employees using personal devices can still work securely through protected mobile applications.

By supporting both paths, the policy balances strong security with practical usability for modern mobile workforces.

Is This a Foundational or Must-Have Policy?

This type of policy is often considered a foundational component of a mobile Conditional Access strategy. Organizations that support mobile productivity almost always need a mechanism to validate mobile devices or applications before granting access.

Without such controls, any mobile device capable of authenticating to Microsoft services could potentially access corporate resources. Introducing device compliance or application protection requirements establishes a clear security baseline for mobile authentication.

Because mobile access continues to grow across most organizations, policies like this one are commonly deployed early in a Conditional Access rollout. They form the foundation for broader device trust strategies and mobile identity protection.

Important Design Choices and Things to Notice

One notable design decision is the use of an OR evaluation model for the access conditions. This means the identity platform does not require both device compliance and an approved application. Instead, either condition can satisfy the policy.

This approach significantly improves flexibility. Organizations can enforce strict device compliance for managed devices while still supporting secure application access on personal devices.

Another important design element is the restriction to mobile platforms. By limiting evaluation to iOS and Android devices, the policy focuses entirely on mobile access scenarios and avoids unnecessary impact on desktop environments.

The use of group-based targeting also reflects a controlled deployment model. Applying policies through groups allows administrators to gradually introduce new security requirements without disrupting the entire user population.

Conditional Access Design Principles Behind This Policy

This policy demonstrates several core principles of modern Conditional Access architecture. The first principle is platform awareness. Conditional Access evaluates the device platform to determine which policies should apply during authentication.

The second principle is adaptive trust. Instead of relying on a single security signal, the identity platform evaluates multiple conditions to determine whether access should be granted. Device compliance and application protection represent two different trust signals that can validate mobile access.

The third principle is layered security. By combining device-based and application-based controls, the organization ensures that at least one protection layer exists for mobile access scenarios.

Together, these principles create a balanced mobile access strategy that protects corporate resources without unnecessarily restricting productivity.

Final Thoughts

Conditional Access iOS Android access control demonstrates how identity platforms can manage the complexity of modern mobile work. Mobile access is no longer limited to corporate devices, and security controls must adapt to that reality.

By allowing access through either compliant devices or protected mobile applications, this policy creates a flexible yet secure mobile access model. It supports both corporate-managed devices and secure application environments for personal devices.

The policy ultimately reflects a practical Conditional Access design philosophy. Security is enforced at the moment of sign-in, using device and application signals to determine whether the environment is trustworthy.

As organizations continue to expand mobile access, policies like this form the backbone of a resilient identity-driven security architecture.