Endpoint

Entra ID & Identity

Conditional Access device filter: why yours matches nothing, and what it cannot protect

An unregistered device has null for every property, so a positive operator can never match it. The mode and operator pairs that hold, and the ones that quietly let devices past.

conditional-access Endpoint Entra ID

23 Aug 2026 11 min

Free: the Intune troubleshooting field guide

Subscribe and get my 8-page PDF: 13 common Intune problems, the order to check them in, and the fix for each. Then Microsoft 365 fixes from the field, about twice a month. From G.R Badhon, Microsoft MVP.

The field guide, sent the moment you confirm

New Intune, Entra ID and Purview guides as they publish

One field-tested fix or script per issue

Apple Business Manager Intune tokens: what each expiry actually breaks

Purview DLP policy not triggering: where the match stops

Intune compliance policy: why the status still lags after a sync

Intune remediation script: the licence gate and exit codes

Intune Device Query: licence, limits and failure modes

Settings catalog vs administrative templates: what Intune still supports

Intune Win32 app deployment: the parts that actually break

Intune driver updates not working: what actually blocks them

Intune management extension: what installs it, where it logs, and why it goes missing

Conditional Access device filter: why yours matches nothing, and what it cannot protect

Free: the Intune troubleshooting field guide