Office 365 activation restriction for company devices only

[Asifahmed]

Hello All,

I just wanted to get a way to restrict the Office 365 activation for company devices only, I dont want user to use their company license on their personal device after installing the office 365 app from https://software.macadmins 

Is it possible to use conditional access in Azure AD, so that only registered company device will be able to activate the office license else no, if yes then still user will be able to register their mac in Azure AD what I think, please clarify me. Thanks in advance.

[piotrr]

It is possible, yes. It is an azure AD matter, you need to create conditional access policies that only allow sign-ins on Macs registered with Intune and compliant. 

[Asifahmed]

But user can register their personal mac in company's Azure AD using by his/her company's email address and password by installing company portal app.  So any other solution?

[piotrr]

Sure, they could do that - but they can't do it if you only allow compliant devices to sign in - even with Company Portal. Normally, everyone makes an exception for Company Portal, so that devices can be enrolled - but you don't need to make such an exception and if you don't, nobody can log in until after the device is compliant, and they can't make it compliant because they can't log in. 

You have near infinite possibilities MEM/Intune conditional access to decide which devices can go through enrollment, for example you might require them to be at the office during enrollment, or to have a certain serial number... all you need to do is make sure that a personal device can never reach conditional access compliance, and require a compliant device to sign in. 

If you only have or allow Mac devices, you could simply make a compliance policy that doesn't include Windows PCs. 

However, these near infinite possibilities also make it easy to accidentally create very convoluted rules. So be careful.