Block Unknown Or Unsupported Device Access

Users will be blocked from accessing company resources when the device type is unknown or unsupported. Global Administrators are excluded as break-glass accounts, because Microsoft requires at least one excluded user, group or role on a policy that blocks all users.

Settings this baseline controls

Setting	What it does
Policy name	Specifies a display name for the Conditional Access Policy Learn more
Enable policy	Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. Learn more
Included users	User IDs in scope of policy Learn more
Included roles	Role IDs in scope of policy Learn more
Included groups	Group IDs in scope of policy Learn more
Included guest types	Guest or external user types in scope of policy Learn more
Excluded users	User IDs excluded from scope of policy Learn more
Excluded roles	Role IDs excluded from scope of policy Learn more

5 more settings

Setting	What it does
Excluded groups	Group IDs excluded from scope of policy Learn more
Excluded guest types	Guest or external user types excluded from scope of policy Learn more
Grant controls	List of values of built-in controls required by the policy. Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue Learn more
Included device platforms	Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue. Learn more
Excluded device platforms	Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

Add this baseline when access should be refused from any device platform your organisation doesn’t use, closing the gap an unrecognised or spoofed client could otherwise slip through.

1. Add the baseline to the tenant directly (see Adding a baseline), or carry it in a scheme you deploy to every tenant you manage (see Deploying a scheme).

2. Leave Included users covering everyone, and use Excluded users or Excluded groups for your organisation’s break-glass accounts.

3. Leave Included device platforms set to any device, and set Excluded device platforms to Android, iOS, Windows and macOS, or whichever of those your organisation uses. The baseline blocks every platform you don’t exclude.

4. Leave Grant controls set to block.

5. Save.

   Turn on Auto-remediation if you want Octiga to reapply the policy whenever it’s changed in Microsoft 365.

Caution

Device platform is read from the client’s own user agent string, which can be altered, so pair this with a device-compliance or app-protection baseline rather than relying on it alone. Check that the platforms you exclude cover everything your organisation uses: Linux and any other platform outside that list is blocked outright.

Licence: Entra ID P1 or P2

This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated — see Licence requirements.

Check it worked

After the next sync, this baseline shows Passing once a policy with state set to enabled, the excluded-platforms condition, and the block grant control exists in Microsoft Entra. You can confirm it in the Microsoft Entra admin centre under Entra ID > Conditional Access > Policies. Users on a supported platform notice nothing; anyone signing in from an unrecognised one is refused access.

Standards this addresses

CISv8 4.1v8 6.4

NISTPR.AC-7SC-7CM-7

ISO 27001A.8.22

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→