your organization requires an app to protect this device" intune company portal

TL;DR

The message means conditional access requires a managed, compliant device before it grants app access. Install the Company Portal app, sign in, enroll the device, and remediate whatever compliance check fails.

The query

"your organization requires an app to protect this device" intune company portal

Use this when

• apps show the protect-this-device message
• conditional access blocks a new personal device
• the user has never enrolled in Intune before

Not for

• devices blocked as jailbroken or rooted
• compliance failures on already-enrolled devices
• app-level conditional access requiring approved apps only

Steps

1. Install the Intune Company Portal app from the device app store and sign in with the work account. Expected output: the portal signs in and shows the device status.
2. Follow the portal prompts to enroll the device in management. Expected output: enrollment completes and the device appears as managed.
3. Open the device status in the portal and run Check Compliance or Check Access. Expected output: the portal lists which checks pass and which fail.
4. Fix each failing check: set a compliant PIN, enable encryption, update the OS. Expected output: all compliance checks turn green.
5. Retry the blocked app. Expected output: conditional access grants access without the prompt.

Applies to

Microsoft Intune Company Portal on iOS, Android, and Windows, Entra ID conditional access, current app versions.

Variant phrasings

Prompt loops back after enrollment

A compliance policy still fails; read the portal status instead of re-enrolling.

Corporate device already enrolled but prompt appears

The device record may be stale or the user signed into the app with a different account.

Why it happens

Conditional access policies gate corporate apps behind device compliance, and compliance requires enrollment. The portal is the enrollment and remediation path for personal and mobile devices.

Edge cases

• Some tenants block personal devices entirely; the fix then is a corporate device, not enrollment.
• Outdated portal versions can misreport status; update the app first.
• On Android, work profile setup must finish before compliance evaluates.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstR6nmGvzSMHxHEoSJk4IJQ