Issue with accessing Office 365 app after deleting Intune company portal from IOS device

Zeeshan Bute 95

Hi,

I deleted the Intune company portal from my IOS phone, but I can still access the Office 365 application. I expected to be denied access after deleting the portal, so I'm not sure what went wrong.

Can someone help me understand why I still have access and how to fix this? I have set up a conditional access policy where I am denied unmanaged/non-compliant devices.

Thank you.

1 answer

Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2024-03-15T07:49:25.4566667+00:00

@Zeeshan Bute, Thanks for posting in Q&A. Based as I know, when you directly remove the company portal app on iOS device, the device record still exists in Intune and Microsoft Entra. So when apply conditional access, it still works.

If you want to unenroll the device from Intune, you can remove it in company portal instead of just remove the app.

https://learn.microsoft.com/en-us/mem/intune/user-help/unenroll-your-device-from-intune-ios

Or you can delete the devices from the Intune admin center to unenroll the device from Intune.

https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe#delete-devices-from-the-intune-admin-center

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Zeeshan Bute 95 Reputation points

2024-03-19T04:43:40.7033333+00:00

Hi @Crystal-MSFT

Thank you for your prompt response.

Hence, the scenario is here, after enrollment user has deleted the company portal from the ISO device and he can still use all the applications, even though the conditional access policy is ACTIVE.

However, after deleting the company portal, it must deny access to the applications.

Can I know, if is there any chance where we can restrict the deletion of the Intune company portal app and/or after deletion, it won't work for that specific user?

Thanks

ZB

Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2024-03-19T05:38:08.61+00:00

@Zeeshan Bute, Thanks for the reply. Based as I know, there's no method to restrict deleting the company portal on the device.

But I know there's a setting named "Compliance status validity period (days)", If a device fails to report its compliance status for a policy before the validity period expires, the device is treated as noncompliant. When the company portal is deleted, the device will not report its compliance status to Intune. We can configure this setting to control the compliance status. When it is not compliant, the office access will be blocked.

https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started#compliance-policy-settings

Zeeshan Bute 95 Reputation points

2024-03-19T07:25:33.4533333+00:00

@Crystal-MSFT Thanks for your quick reply.

Can you guide me with the test policy?

So, I can understand the steps.

Thanks

ZB

Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2024-03-19T08:26:03.6966667+00:00

@Zeeshan Bute, Thanks for the reply. We can go to Intune portal, Devices->Compliance->Compliance settings, set "Compliance status validity period (days". For example, when we set it as 5 days, then the device which does not contact Intune for 5 days will be marked as non-compliant.

Zeeshan Bute 95 Reputation points

2024-03-19T10:49:30.6033333+00:00

Thanks @Crystal-MSFT this will help.

Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2024-03-21T01:43:30.3966667+00:00

@Zeeshan Bute, Great! I am glad the information can help. Have a nice day!
Sign in to comment