See the Explanation below for complete Solution.
Explanation:
To implement additional security checks for the members of the Sg-Executive group, ensuring they meet the specified conditions before accessing company apps, you can follow these steps:
* Open Microsoft Entra admin center:
* Sign in with an account that has Global Administrator or Intune Administrator privileges.
* Navigate to Conditional Access:
* Go to Security > Conditional Access.
* Create a New Policy:
* Click on New policy.
* Give the policy a name, such as "Sg-Executive Security Checks".
* Set Users and Groups:
* Under Assignments, select Users and groups.
* Choose Select users and groups and pick the Sg-Executive group.
* Configure Conditions:
* Under Conditions, select Device state.
* Configure the settings to include devices marked as compliant by Microsoft Intune.
* Set Access Controls:
* Under Access controls, go to Grant.
* Choose Grant access and select Require device to be marked as compliant.
* Also, select Require approved client app and Require app protection policy12.
* Enable Policy:
* Set Enable policy to On.
* Click Create to activate the policy.
By setting up this Conditional Access policy, you ensure that members of the Sg-Executive group can only access company apps from devices that are compliant with Microsoft Intune or from client apps that are protected by app protection policies. This aligns with the security conditions you've outlined