Skip to content

policy-all-users-device-unknown-unsupported.md

Latest commit

 

History

History
48 lines (37 loc) · 2.58 KB

policy-all-users-device-unknown-unsupported.md

File metadata and controls

48 lines (37 loc) · 2.58 KB
title Block unsupported platforms with Conditional Access
description Create a custom Conditional Access policy blocking unsupported platforms.
ms.topic how-to
ms.date 03/24/2026
ms.reviewer lhuangnorth

Block unknown or unsupported device platform

Overview

Users are blocked from accessing company resources when the device type is unknown or unsupported.

The device platform condition is based on user agent strings. Conditional Access policies using this condition should be used with another policy, like one requiring device compliance or app protection policies, to mitigate the risk of user agent spoofing.

User exclusions

[!INCLUDE active-directory-policy-exclusions]

[!INCLUDE active-directory-policy-deploy-template]

Create a Conditional Access policy

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Give your policy a name. Create a meaningful standard for the names of your policies.
  5. Under Assignments, select Users or workload identities.
    1. Under Include, select All users
    2. Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
  6. Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps').
  7. Under Conditions, select Device platforms
    1. Set Configure to Yes.
    2. Under Include, select Any device
    3. Under Exclude, select Android, iOS, Windows, and macOS.

      [!NOTE] For this exclusion, select any platforms that your organization uses, and leave the others unselected.

    4. Select, Done.
  8. Under Access controls > Grant, select Block access, then select Select.
  9. Confirm your settings and set Enable policy to Report-only.
  10. Select Create to enable your policy.

[!INCLUDE conditional-access-report-only-mode]

Related content