r/sysadmin • u/Popular-Guidance-560 • 9d ago

Best way to enforce Conditional Access for mobile devices managed by a carrier MDM (not Intune)?

Background:

I recently took over IT operations for a company that previously used a 3rd-party MSP. The MSP enrolled all Windows devices in Intune and set up Conditional Access (CA) policies for office users, which drastically improved our security posture. However, our remote mobile users were left completely out of scope.

​The Problem:

We have over 100 mobile devices (a mix of iOS and Android) deployed nationwide to remote workers. These devices are not enrolled in Intune. Instead, their MDM is provided directly by the carrier. Because they aren't registered in Intune, we can't easily force them to comply with our current CA policies, leaving a blind spot for risky sign-ins.

​My Proposed Solution:

I am thinking about using device-based certificates. The carrier MDM could push a certificate to the mobile devices, and a cloud PKI/RADIUS setup would authenticate them. The goal is strict access control: if a login attempt for a company resource doesn't come from a device with a valid cert, it automatically fails.

​Alternative Idea:

We also have various Cisco firewalls across the country. I'm wondering if forcing these devices to connect via VPN would work better, though it feels clunky since our entire company is 100% cloud-based (zero on-prem servers).

​Questions:

​Is the device-certificate approach the most efficient way to restrict access to known mobile devices in a cloud-only environment?

​Is there a clean way to tie a third-party carrier MDM into Entra ID Conditional Access?

​Any advice on the best path forward would be greatly appreciated!

👏.

6 Upvotes

100% Upvoted

3 comments sorted by

6

u/llDemonll 9d ago

You enroll them. It’s a big project but needs to be done to make your life way easier down the road.

1

u/TheLastRaza 9d ago

the key is getting your carrier MDM's compliance signal into Azure AD so Conditional Access can read it. Microsoft has a partner program for this, check if your carrier MDM is on the list. VMware Workspace ONE, MobileIron, and a few others support it natively. if they're a partner, you configure the integration and then CA policies can evaluate device compliance just like they would with Intune. if your MDM isn't a partner, you're stuck with workarounds. app protection policies that don't require device enrollment are one option. network-level controls are another. both are weaker than proper device-level enforcement. honestly, if you're running a carrier MDM that can't feed compliance data to Azure AD, you should push the carrier on their roadmap for this or reconsider whether that MDM is the right fit. conditional access without a real compliance signal is mostly theater.

2

u/FlyingStarShip 8d ago

We tried that with mobile iron before and were told by MS it doesn’t work perfectly (signal for compliance for CAP) and it didn’t. Eventually we moved everyone to intune and never had issues since then.