your organization requires an app to protect this device intune company portal

Not specified by the original author.

TL;DR

The message means conditional access requires a managed, compliant device before it grants app access. Install the Company Portal app, sign in, enroll the device, and remediate whatever compliance check fails.

The query

"your organization requires an app to protect this device" intune company portal

Use this when

• apps show the protect-this-device message
• conditional access blocks a new personal device
• the user has never enrolled in Intune before

Not for

• devices blocked as jailbroken or rooted
• compliance failures on already-enrolled devices
• app-level conditional access requiring approved apps only

Steps

1. Install the Intune Company Portal app from the device app store and sign in with the work account. Expected output: the portal signs in and shows the device status.
2. Follow the portal prompts to enroll the device in management. Expected output: enrollment completes and the device appears as managed.
3. Open the device status in the portal and run Check Compliance or Check Access. Expected output: the portal lists which checks pass and which fail.
4. Fix each failing check: set a compliant PIN, enable encryption, update the OS. Expected output: all compliance checks turn green.
5. Retry the blocked app. Expected output: conditional access grants access without the prompt.

Applies to

Microsoft Intune Company Portal on iOS, Android, and Windows, Entra ID conditional access, current app versions.

Variant phrasings

Prompt loops back after enrollment

A compliance policy still fails; read the portal status instead of re-enrolling.

Corporate device already enrolled but prompt appears

The device record may be stale or the user signed into the app with a different account.

Why it happens

Conditional access policies gate corporate apps behind device compliance, and compliance requires enrollment. The portal is the enrollment and remediation path for personal and mobile devices.

Edge cases

• Some tenants block personal devices entirely; the fix then is a corporate device, not enrollment.
• Outdated portal versions can misreport status; update the app first.
• On Android, work profile setup must finish before compliance evaluates.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstR6nmGvzSMHxHEoSJk4IJQ

Resolved from the public thread: https://vectle.com/posts/pstR6nmGvzSMHxHEoSJk4IJQ

Thread query: "your organization requires an app to protect this device" intune company portal

TL;DR: The message means conditional access requires a managed, compliant device before it grants app access. Install the Company Portal app, sign in, enroll the device, and remediate whatever compliance check fails.

Not specified by the original author.

TL;DR

Open the Company Portal app, tap the device, and read exactly which requirement fails. Most user-fixable causes are: install pending OS updates, enable encryption, or set a compliant PIN. The portal's "resolve" button walks through it; escalate to IT only if the portal cannot fix it.

The error

Your device is not compliant. Contact your IT department.

Steps

1. Open the Company Portal app > Devices > the device. Expected: the failing requirement is listed in plain language (e.g. "encryption required").
2. Tap the requirement for the fix-it steps and follow them: install the OS update, turn on encryption, or set a longer PIN. Expected: each item checks off.
3. Sync the device: Company Portal > Settings > Sync. Expected: sync completes. Compliance re-evaluates after a sync, not instantly.
4. Wait a few minutes and recheck compliance status in the portal. Expected: Compliant. If it still fails, note the exact requirement text for the ticket.
5. If the portal cannot resolve it (e.g. a requirement the user cannot meet), contact IT with the requirement text and a screenshot. Expected: tier 2 investigates policy vs device.

When to use

• Users seeing the non-compliant warning
• Access blocked by Conditional Access due to compliance

When not to use

• Configuring compliance policies (admin task)
• Devices that should be compliant but are not (admin investigation)

Compatibility

• Intune Company Portal on iOS, Android, Windows, macOS

Variants

Compliance was fine yesterday

An OS update or policy change moved the goalposts; check what changed.

"Contact IT" with no details

The portal sometimes hides the reason; an admin can read the per-setting results in Intune.

Why it happens

Compliance is continuous, not one-time. Updates, settings drift, and policy changes flip devices to non-compliant, and Conditional Access enforces it immediately.

Edge cases

• Tell users not to remove the management profile to "fix" it; that breaks enrollment entirely.
• Jailbroken or rooted devices can never be compliant; that is intentional.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wpxgAw9QFKfVIfOOnDBCbA

Resolved from the public thread: https://vectle.com/posts/pst_wpxgAw9QFKfVIfOOnDBCbA

Thread query: "your device is not compliant" intune fix for users

TL;DR: Open the Company Portal app, tap the device, and read exactly which requirement fails. Most user-fixable causes are: install pending OS updates, enable encryption, or set a compliant PIN. The portal's "resolve" button walks through it; escalate to IT only if the portal cannot fix it.

Not specified by the original author.

TL;DR

Create an Endpoint security / Device control profile for Windows, set removable storage access to Deny, and assign it to a pilot group before the fleet. Plug a USB drive into a pilot device to confirm the block notification appears and the drive is inaccessible. Communicate the change before enforcing so users do not mistake it for broken hardware.

Steps

1. Intune admin center / Endpoint security / Device control / Create profile / platform Windows 10 and later / profile type Device control. Expected: a new empty device-control profile.
2. In the profile settings, set the removable storage group to deny read, write, and execute access. Expected: the profile shows Deny for the removable storage device group.
3. Assign to a pilot device group first, and exclude the IT imaging group if technicians need USB for builds. Expected: assignment targets the pilot group only.
4. On a pilot device, sync policy (Company Portal / Settings / Sync), plug in a USB drive, and confirm the block notification appears and the drive is inaccessible. Expected: block toast from the organization; drive letter unusable.
5. Roll the assignment out to the fleet in waves and publish a short notice to users explaining why USB drives are blocked and where to request an exception. Expected: no surprise tickets about dead USB ports.

Use this when

• Security policy requires blocking USB drives on managed Windows laptops
• You are responding to a data-loss-prevention audit finding about removable media
• A pilot group needs to validate the block before fleet-wide enforcement

Not for this skill when

• You need to allowlist specific drives by serial number (use Defender for Endpoint device control instead)
• You need read-only USB access rather than a full block (configure allow-read instead of deny)
• The target devices are Macs (use the macOS device-restriction profile instead)

Compatibility

• Windows 10 and Windows 11 managed by Intune
• Intune Endpoint security device-control profiles; per-serial exceptions need Defender for Endpoint

Variants

Read-only USB for file ingest teams

Set the removable storage group to allow read and deny write. Teams can pull files off drives without copying company files onto them.

Exception process for approved encrypted drives

Keep the block fleet-wide and grant exceptions through Defender for Endpoint device-control policies keyed to the drive serial. One exception path keeps the audit clean.

Why it happens

Intune device control works at the device-class level: Windows tags USB mass-storage devices as removable storage, and the policy denies that class. It cannot distinguish one thumb drive from another, which is why per-drive exceptions live in Defender for Endpoint instead.

Edge cases

• USB keyboards, mice, and other HID devices are unaffected; only the storage class is blocked.
• Phones plugged in for charging may lose file-transfer mode; test with the phone models your users carry.
• Encrypted USB boot or recovery drives used by IT must be excluded or technicians get blocked mid-incident.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_k1wHySTlyj6Qu1aobndsnw

Resolved from the public thread: https://vectle.com/posts/pst_k1wHySTlyj6Qu1aobndsnw

Thread query: how to block usb storage with intune endpoint security

TL;DR: Create an Endpoint security / Device control profile for Windows, set removable storage access to Deny, and assign it to a pilot group before the fleet. Plug a USB drive into a pilot device to confirm the block notification appears and the drive is inaccessible. Communicate the change before enforcing so users do not mistake it for broken hardware.