Forcing Device Enrollment with Conditional Access

[JustinL]

Hi All,

 

Wondering how others are forcing existing Exchange ActiveSync users to enroll in Intune. I've setup Intune integrated into our SCCM Current Branch (1602) environment and configured the Exchange Server Connector to sync devices from our On-Premise Exchange 2013 environment. All EAS devices are syncing into SCCM and I've successfully deployed Exchange On-Prem Conditional Access to a targeted user collection. For users in the targeted collection that have devices connecting to EAS via the native iOS or Android mail client things seem to work as expected. These users receive the CA email notification which provides instruction on how to enroll. Once they enroll, their device is then able to resume using EAS to send/receive email. This all works great.

 

Here is where I'm running into an issue. We have a high percentage of users who are using the Outlook mobile app for both iOS and Android instead of the native mail client on their devices to connect to Exchange. The Exchange connector is syncing these devices into SCCM. They show up as Name=Username_Outlook and Device Type=Outlook. However users with an "Outlook" device are some how not being effected by the CA policy that is being deployed to them. Because of this I am not able to force their devices to enroll in Intune.

 

So with all of that background can anyone tell me how I can deploy CA to users with devices using the Outlook App and force them to enroll their devices?

 

 

I have found some documentation on deploying CA for Outlook mobile but it all seems to be related to 0365 and Exchange Online policy settings. We are not running 0365 and do not have a cloud based Exchange, everything is on-prem.

 

 

 

Thanks in advanced for any help on this.

 

Justin

[Peter van der Woude]

The main problem in that scenario is that the Outlook app is not supported for conditional access with Exchange on-premises.