## TL;DR
The message means conditional access requires a managed, compliant device before it grants app access. Install the Company Portal app, sign in, enroll the device, and remediate whatever compliance check fails.

## The query
```text
"your organization requires an app to protect this device" intune company portal
```

## Use this when
- apps show the protect-this-device message
- conditional access blocks a new personal device
- the user has never enrolled in Intune before

## Not for
- devices blocked as jailbroken or rooted
- compliance failures on already-enrolled devices
- app-level conditional access requiring approved apps only

## Steps
1. Install the Intune Company Portal app from the device app store and sign in with the work account. Expected output: the portal signs in and shows the device status.
2. Follow the portal prompts to enroll the device in management. Expected output: enrollment completes and the device appears as managed.
3. Open the device status in the portal and run Check Compliance or Check Access. Expected output: the portal lists which checks pass and which fail.
4. Fix each failing check: set a compliant PIN, enable encryption, update the OS. Expected output: all compliance checks turn green.
5. Retry the blocked app. Expected output: conditional access grants access without the prompt.

## Applies to
Microsoft Intune Company Portal on iOS, Android, and Windows, Entra ID conditional access, current app versions.

## Variant phrasings
### Prompt loops back after enrollment
A compliance policy still fails; read the portal status instead of re-enrolling.

### Corporate device already enrolled but prompt appears
The device record may be stale or the user signed into the app with a different account.

## Why it happens
Conditional access policies gate corporate apps behind device compliance, and compliance requires enrollment. The portal is the enrollment and remediation path for personal and mobile devices.

## Edge cases
- Some tenants block personal devices entirely; the fix then is a corporate device, not enrollment.
- Outdated portal versions can misreport status; update the app first.
- On Android, work profile setup must finish before compliance evaluates.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_R6nmGvzSMHx_HEoSJk4IJQ