How to block access to Azure Portal from personal devices (Conditional Access)?

As the user mentioned, Azure Portal is not available. You have seemed to gloss right over that. Example:

Hello Suppachai Chommaporn,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I will try to clarify your doubts and propose you some solutions.

So, when you're trying to block access to the Azure Portal from personal devices using Conditional Access but are facing issues selecting the Azure Portal in your configurations.

Before we proceed further would like to know below points as:

What specific OS platforms do the personal devices use? Are you using Microsoft Intune for device management? Can you confirm if you have the correct permissions and licenses in place? Are there any error messages displayed when you attempt to select the Azure Portal?

Till then will suggest you below solution steps like:

1. Conditional Access Policies Basics: To start with, Conditional Access policies are essentially "if-then" statements that enforce access requirements based on certain conditions. In your case, you want to ensure that only managed devices can access the Azure Portal.
2. Configure Access Controls:
   • You can achieve this by requiring devices to be either compliant with Mobile Device Management (MDM) policies (like Intune) or hybrid joined devices. This means only registered and managed devices would be allowed access.
3. Creating a New Policy:
   • Sign in to the Microsoft Entra admin center as a Conditional Access Administrator.
   • Navigate to Entra ID > Conditional Access > Policies.
   • Click on New policy and give your policy a name.
   • In Assignments, specify the users or groups this policy will apply to.
   • For Cloud apps, select resources to apply your policy to (note: ensure you include the Azure Portal).
   • Under Conditions, specifically check device platforms to make sure you specify excluded platforms (like iOS, Android, etc.).
   • Under Access Controls, select Grant and choose the option to Require device to be marked as compliant.
4. Testing the Policy:
   • Before enabling the policy, set it to Report-only mode to test its impacts. Use tools like the what-if tool to simulate sign-ins and see potential outcomes.
5. Monitoring and Adjusting: After implementation, monitor the policy to ensure that it’s functioning as intended without locking out users accidentally.

NOTE:

• If you're unable to select the Azure Portal specifically, make sure you have the required permissions and license (Microsoft Entra ID P1 or P2).
• Review any user or endpoint that might need adjusting to suit the Conditional Access criteria set in your policy.

Please do refer below docs for better understanding:

• How to configure device-based Conditional Access policies
• Create conditional access policies
• Testing and Monitoring Conditional Access Policies

Hope this helps! If it answered your question, please consider clicking Accept Answer and Upvote. This will help us and others in the community as well.

If you need more info, feel free to ask in the comments. Happy to help!

Regards,

Monalisha