Conditional Access: Why You Sometimes Get Blocked
Conditional Access: The Gatekeeper
Have you ever tried to open Outlook or Teams and gotten a message saying "You can't access this resource" or "Your device doesn't meet compliance requirements"? That's Conditional Access at work.
What is Conditional Access?
Conditional Access is Microsoft's way of enforcing security rules before letting you access company resources. Think of it as a security guard at the door of a building — the guard checks your ID, verifies you're allowed in, and only then opens the door.
Conditional Access evaluates conditions and then either allows or blocks access:
| Condition | Example |
|---|---|
| Device compliance | "Only compliant devices can access Outlook" |
| Approved apps | "Only Outlook and Teams can access company data — not the native mail app" |
| Location | "Block access from certain countries" |
| Sign-in risk | "If sign-in looks suspicious (unusual location), require MFA" |
| MFA requirement | "Require multi-factor authentication for all sign-ins" |
When You'll Encounter Conditional Access
Conditional Access typically kicks in when you try to access:
- Outlook (web, desktop, or mobile)
- Microsoft Teams
- SharePoint and OneDrive for Business
- Company VPN
- Any Microsoft 365 app that IT has protected
Common Block Messages and What They Mean
"Your device is not compliant"
Meaning: Your device failed one or more compliance checks.
Fix: Open Company Portal, check what's wrong, fix it, and sync.
"You can't get there from here"
Meaning: You're trying to access a resource from a location or network that IT has blocked.
Fix: Use a company-approved VPN or try from a different network. Contact IT if you believe this is an error.
"Approved app required"
Meaning: You're using an app that IT hasn't approved. For example, trying to access work email through the native iOS Mail app instead of Outlook.
Fix: Install and use the approved app (usually Outlook for email).
"More information required — MFA needed"
Meaning: Conditional Access is requiring multi-factor authentication for this sign-in.
Fix: Approve the MFA prompt on your phone, enter the code, or use your authenticator app.
The Relationship Between Compliance and Conditional Access
Compliance policies and Conditional Access work together:
- Compliance policy = "Your device must have a password, encryption, and be up to date"
- Conditional Access = "If the device is NOT compliant, block access to Outlook, Teams, and SharePoint"
Without Conditional Access, compliance policies would just be warnings — you could ignore them and still access everything. Conditional Access is what gives compliance policies teeth.
What to Do When You're Blocked
Follow this troubleshooting flow:
- Don't panic — being blocked doesn't mean you're in trouble. It means a security policy is working as designed.
- Open Company Portal — check your compliance status
- Fix the issue — Company Portal will tell you exactly what's wrong
- Sync — Tap "Sync" in Company Portal
- Wait 5-15 minutes — Conditional Access re-evaluates periodically, not instantly
- Try again — Close and reopen the blocked app
- If still blocked — Contact IT with the specific error message
Pro Tip: Take Screenshots
When you get a Conditional Access block message, take a screenshot before closing it. The exact error message helps IT diagnose the issue much faster than "I can't get into my email."
Beawit Consulting designs Conditional Access policies that balance security with user productivity. Contact us for Microsoft 365 security configuration.
Next, we'll look at app protection policies — how Intune secures company data within individual apps.
There are no comments for now.