NSP.M365.ConditionalAccess

0.1.0

Policies/NSP-INTUNE-COMPLY-02.psd1

@{
    Id = 'NSP-INTUNE-COMPLY-02'
    Name = 'Mobile Intune access: compliant device or hourly MFA'
    Version = 1
    Description = 'On Android and iOS, access to Microsoft Intune requires a compliant device or MFA, re-prompted every hour.'
    Notes = 'Converted from Legacy/Policies/Intune_CompliantOrMFA.ps1.'
    LegacyNames = @('Intune - Compliant or MFA')
    DefaultState = 'reportOnly'

    Users = @{
        IncludeGroups = @('{Group:EnableMFA}', '{Group:MFACatchAll}')
        ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}')
    }
    Applications = @{
        Include = @('{App:Microsoft Intune}')
    }
    Platforms = @{
        Include = @('android', 'iOS')
        Exclude = @('windowsPhone', 'windows', 'macOS')
    }

    Grant = @{
        Operator = 'OR'
        BuiltInControls = @('mfa', 'compliantDevice')
    }
    Session = @{
        SignInFrequency = @{ Value = 1; Type = 'hours' }
    }
}