Mastering Intune Conditional Access: Troubleshooting Common Issues and Solutions

Table of Contents

Microsoft Intune Conditional Access is a powerful tool that allows organizations to secure access to corporate resources based on specific conditions. While robust, administrators and users may encounter challenges when implementing and using Conditional Access policies. This article provides guidance on troubleshooting common issues related to Intune Conditional Access and offers practical solutions to ensure seamless and secure access to your organization’s data.

Common Intune Conditional Access Issues and Their Resolutions¶

Navigating the complexities of Intune Conditional Access can sometimes lead to unforeseen issues. Understanding these common problems and their solutions is crucial for maintaining a secure and productive environment. Below are frequently encountered scenarios and step-by-step resolutions to guide you through troubleshooting.

1. Licensing Prerequisites: Ensuring Users are Properly Licensed¶

One of the foundational requirements for Intune Conditional Access to function correctly is proper licensing. Users must be assigned an appropriate Intune license to be evaluated for compliance and to be subject to Conditional Access policies. If a user lacks the necessary license, they will not be correctly assessed, leading to unexpected access issues or policy application failures.

Solution:

• Verify License Assignment: The first step is to ensure that the user experiencing access issues has an active Intune license assigned to their account. This can be checked within the Microsoft 365 admin center or the Azure portal under the user’s account details.
• License Type: Confirm that the assigned license includes Intune capabilities. Different Microsoft 365 and Enterprise Mobility + Security (EMS) licenses offer varying levels of Intune features. Ensure the license aligns with the Conditional Access policies you have implemented.
• Propagation Delay: After assigning a license, allow some time for the changes to propagate throughout the Microsoft 365 services. It’s advisable to wait for a short period before testing Conditional Access policies for newly licensed users.

2. Non-Knox Android Devices and Quarantine Emails¶

Android devices that are not based on the Knox platform may encounter a specific behavior when subject to Conditional Access policies. These devices might be placed in quarantine initially, even if they are enrolled in Intune and seemingly compliant. This is due to a specific process required for non-Knox Android devices to fully register with Intune for Conditional Access.

Solution:

• “Get Started Now” Link: Users of non-Knox Android devices will receive a quarantine email containing a Get Started Now link. This link is crucial for initiating the final steps of device registration and compliance evaluation.
• User Action Required: Users must click the Get Started Now link within the quarantine email on their Android device. This action triggers the necessary processes for the device to be fully recognized by Intune and granted access according to Conditional Access policies.
• Email Accessibility: If a user does not receive the quarantine email on their device, they can access their email through a PC and forward the email to an account accessible on their Android device. This ensures they can access and click the Get Started Now link.
• One-Time Action: This process is typically a one-time action required when Conditional Access is initially applied or when a device is newly enrolled. Subsequent access attempts should not require this step, assuming the device remains compliant.

3. Enrollment and Update Delays in Compliance Registration¶

When a device is newly enrolled in Intune or undergoes a significant update, there can be a delay before compliance information and device attributes are fully registered within the Intune service. During this period, devices might appear non-compliant or experience issues accessing resources governed by Conditional Access policies.

Solution:

• Patience is Key: Allow sufficient time for the device to synchronize with Intune and for compliance status to be accurately reflected. This process can take several minutes, especially immediately after enrollment or a major update.
• Wait and Retry: Advise users to wait for a reasonable period, such as 10-15 minutes, after enrollment or update before attempting to access corporate resources. After waiting, instruct them to try accessing the resource again.
• Manual Sync (Company Portal): Users can manually initiate a sync from the Company Portal app. This can sometimes expedite the process of compliance information registration. In the Company Portal app, navigate to “Devices,” select the device, and look for a “Sync” or “Check Status” option.

4. iOS/iPadOS Email Profile Conflicts¶

iOS and iPadOS devices can encounter conflicts with existing email profiles when an Intune-managed email profile is deployed via Conditional Access. If a user has manually configured an email profile on their device, it can block the deployment of the Intune-created profile, leading to the device being marked as non-compliant.

Solution:

• Company Portal Notification: The Company Portal app will typically notify users if a manually configured email profile is causing a compliance issue. The notification will indicate that the device is non-compliant due to the existing email profile.
• Prompt to Remove Existing Profile: The Company Portal app will prompt the user to remove the conflicting manually configured email profile. This is a necessary step to allow the Intune email profile to be successfully deployed.
• User Action - Profile Removal: Users must manually remove the existing email profile from their iOS/iPadOS device settings. This is usually done in Settings > Mail > Accounts.
• Pre-Enrollment Instructions: To prevent this issue proactively, organizations should instruct users to remove any existing email profiles on their iOS/iPadOS devices before enrolling in Intune. This preemptive step avoids the conflict and ensures a smoother enrollment process.

5. Devices Stuck in “Checking Compliance” State¶

Occasionally, a device might get stuck in a “checking-compliance” state. This can prevent users from initiating further check-ins or accessing resources. This state indicates that the device is attempting to evaluate its compliance status but is unable to complete the process.

Solution:

• Company Portal App Update: Ensure the device is running the latest version of the Company Portal app. Outdated versions may have bugs or compatibility issues that cause compliance checks to stall. Update the Company Portal app from the App Store or Google Play Store.
• Device Restart: A simple device restart can often resolve temporary glitches that might be causing the “checking-compliance” state. Restarting the device clears temporary caches and processes, potentially resolving the issue.
• Network Connectivity Test: Investigate if the problem persists across different network connections. Try switching between Wi-Fi and cellular data to rule out network-related problems. Firewalls or network restrictions could sometimes interfere with compliance checks.
• Microsoft Support: If the issue persists after trying the above steps, it may indicate a more complex problem. In such cases, contacting Microsoft Support for Intune is recommended. They can provide deeper troubleshooting and potentially identify backend issues. Refer to Microsoft’s support resources for guidance on contacting Intune support.

6. Android Encryption Recognition Issues¶

Some Android devices, despite appearing to be encrypted, may be incorrectly identified as not encrypted by the Company Portal app. This discrepancy leads to the device being marked as non-compliant based on encryption policies. The issue often stems from how certain manufacturers implement encryption.

Solution:

• Company Portal Notification - Startup Passcode: In this scenario, the Company Portal app will typically display a notification prompting the user to set a startup passcode for the device. This notification is the key indicator of this specific encryption recognition issue.
• Action on Notification: Users should tap the notification within the Company Portal app. This will guide them through the process of setting a secure startup passcode.
• Secure Startup Setting: After tapping the notification and confirming their existing PIN or password (if any), users will be presented with the Secure start-up screen. On this screen, they must choose the option Require PIN to start device. This setting enforces device encryption from startup.
• Check Compliance Again: After setting the “Require PIN to start device” option, instruct the user to tap the Check Compliance button within the Company Portal app. This re-evaluates the device’s compliance status. The device should now be correctly detected as encrypted and marked as compliant.

Note on Default PIN Encryption: It’s important to understand that some device manufacturers encrypt devices using a default PIN instead of a user-defined PIN. Intune considers encryption based on a default PIN as insecure. Therefore, devices using default PIN encryption will be flagged as non-compliant until the user creates a new, non-default PIN. Enforcing a user-defined startup PIN addresses this security concern and resolves the compliance issue.

7. Android Devices Blocked After Enrollment (Initial Access)¶

An Android device that is successfully enrolled and compliant might still be blocked and receive a quarantine notice when initially attempting to access corporate resources. This can occur even after the device appears to be fully set up and compliant within Intune. This is often related to the timing of policy application and device registration.

Solution:

• Close Company Portal App: Ensure the Company Portal app is completely closed and not running in the background on the Android device.
• “Get Started Now” Link (Again): Select the Get Started Now link from the quarantine email again. Even if the user clicked it during initial setup, clicking it again after enrollment can trigger the necessary backend processes for access to be granted.
• Trigger Evaluation: Clicking the Get Started Now link in this situation essentially re-triggers the Conditional Access evaluation process. This allows Intune to properly recognize the enrolled and compliant device and grant access.
• One-Time Requirement: This step is usually required only when Conditional Access is first enabled for a user or after a significant policy change. Subsequent access attempts should not require this repeated action.

8. Android “No Certificates Found” Error¶

Users on enrolled Android devices might encounter a “No certificates found” prompt and be denied access to Microsoft 365 resources. This error indicates that the device is not presenting the necessary certificate for authentication, even though it is enrolled and should have the required certificates. This is often related to browser access settings within the Company Portal app.

Solution:

• Enable Browser Access: The user needs to enable the Enable Browser Access option within the Company Portal app settings. This setting is essential for allowing browser-based authentication and certificate usage for accessing Microsoft 365 resources.
• Step-by-Step Instructions: Guide users through the following steps:
  1. Open Company Portal App: Launch the Company Portal application on their Android device.
  2. Access Settings: Navigate to the Settings page within the Company Portal app. This might be accessible via triple dots (…) menu or a hardware menu button depending on the device.
  3. Enable Browser Access: Locate and select the Enable Browser Access button or option. Toggle it to the “on” or “enabled” state.
  4. Sign Out of Microsoft 365 (Chrome): In the Chrome browser (or the default browser used for accessing Microsoft 365), sign out of all Microsoft 365 accounts.
  5. Restart Chrome: Close and restart the Chrome browser. This ensures the changes and certificate settings are properly applied.

After completing these steps, users should be able to access Microsoft 365 resources through the browser without the “No certificates found” error.

9. Modern Authentication for Desktop Applications¶

Desktop applications accessing Microsoft 365 resources must utilize modern authentication methods to comply with Conditional Access policies. Modern authentication relies on authentication prompts displayed either in a web browser or through an authentication broker. Legacy authentication methods, such as sending passwords directly, are often blocked by Conditional Access policies for security reasons.

Solution:

• Modern Authentication Requirement: Ensure that desktop applications used to access Microsoft 365 are configured to use modern authentication protocols like OAuth 2.0 and OpenID Connect.
• Authentication Broker Usage: For applications or scripts that need to authenticate programmatically, using an authentication broker is crucial. Authentication brokers securely handle the authentication process and provide proof of device identity to meet Conditional Access requirements.
• Avoid Direct Password Transmission: Scripts or applications that directly send passwords (e.g., using Resource Owner Password Credentials - ROPC flow in OAuth 2.0 without a broker) should be avoided. These methods are less secure and are likely to be blocked by Conditional Access policies designed to enhance security.
• Update Applications: If you encounter issues with desktop applications and Conditional Access, verify that the applications are updated to the latest versions, as newer versions are more likely to support modern authentication.

By understanding and addressing these common Intune Conditional Access issues, organizations can maintain a secure and user-friendly environment. Regularly reviewing and updating your Conditional Access policies, along with proactively communicating these troubleshooting steps to users, will contribute to a smoother and more secure experience.

---

If you’ve encountered other Intune Conditional Access challenges or have additional troubleshooting tips, please share them in the comments below! Your experiences can help others in the community.