What the organization was facing
The company wanted stronger control over who and what could reach company data. A password-only decision could not distinguish between an approved, encrypted company device and an unmanaged device using otherwise valid credentials.
The new controls also had to fit everyday work. A security design that required constant manual exceptions or interrupted legitimate employees would not remain effective for long.
The decision behind the work
The access model joined identity verification with device trust. Covered users would need multi-factor authentication, and the device itself would need to be enrolled, encrypted, and reporting the required compliance state before access was granted.
How the project moved
Strengthen user verification
Implemented Conditional Access policies requiring multi-factor authentication for the users and company resources included in the project.
Enroll and evaluate devices
Brought covered devices into Intune so access decisions could use managed compliance information instead of trusting credentials alone.
Require the agreed device baseline
Configured compliance checks for BitLocker encryption and TPM 2.0 before a covered device could reach company resources.
Enforce the combined decision
Connected the compliance result to Conditional Access so both verified identity and an approved device state were required.
How the work was checked
- Confirmed that compliant, enrolled devices could complete the expected sign-in workflow.
- Confirmed that the policy evaluated device encryption and hardware trust rather than relying only on a successful password and MFA prompt.
What changed
Access to the covered company systems required both a verified user and a compliant, encrypted device. The implemented policy replaced password-only entry with an enforceable identity-and-device decision.
Because Intune supplied the compliance state automatically, the stronger access standard did not depend on someone manually reviewing every ordinary sign-in.