Whether Device compliant Info can be passed by a corporated managed MDM enrolled android device with Managed Edge (InPrivate)?

Question

Whether Device compliant Info can be passed by a corporated managed MDM enrolled android device with Managed Edge (InPrivate)?

Choi, Jacky Chun Wing 20

I had configured a Conditional Access Policies that detects the device information and determine the SFA / MFA requirement for accessing the corporate application.

CA Policy Overview:

If device is compliant and device ownership is "Company"--> allow access with SFA

If device ownership is not "Company"--> allow access with MFA

With the above design, the detection of device ownership and compliance would be a key to affect the user login behaviour. I would like to know if the browser type (inPrivate or not, and Desktop / mobile version) will make a difference to the CA policy evaluation, i.e. whether the CA policy can get the device info (e.g. device id, device ownership, device compliance) with the below conditions:

Assume some general conditions -

Device OS: Android Enterprise MDM Enable?: Yes, in corporate owned mode

Case 1: Edge Browser (InPrivate mode) - "View desktop site"

Case 2: Edge Browser (InPrivate mode) - Mobile version

Case 3: Edge Browser (Normal mode) - "View desktop site"

Case 4: Edge Browser (Normal mode) - Mobile version

Thank you for your attention and appreciate any response to my question. Thank you.

BR, Jacky

Anton W 6 Reputation points

2026-10-07T10:47:11.2733333+00:00

Hi @Choi, Jacky Chun Wing ,

Firstly, I would recommend against only allowing SFA for corporate devices as this would be considered an anti-pattern or rather, not "Zero-trust".

If the device is a personal device, then it is recommended to use MAM policies to protect your corporate data on that personal device.

Generally speaking, if you try to authenticate against Entra ID on a mobile device using a private browser session (or even a entra-joined windows device), the device identity is not passed with the request and any CA Policy requiring a "compliant" or "corporate" device will fail Conditional Access policy. You can see this in the sign-in logs in Entra ID where the device ID on the "device info" tab is blank.

Granted device is registered with Entra ID, in a normal browser session, your logic should work. But again, from a security standpoint, this design is not recommended.

What other tip, when you're working with CA Policies, you can use the "What-if" tool to simulate authentication flows with specified conditions to see how your CA Policies would perform:

2 answers

Your answer

Anton W 6 Reputation points

2026-10-07T10:47:11.2733333+00:00

Hi @Choi, Jacky Chun Wing ,

Firstly, I would recommend against only allowing SFA for corporate devices as this would be considered an anti-pattern or rather, not "Zero-trust".

If the device is a personal device, then it is recommended to use MAM policies to protect your corporate data on that personal device.

Generally speaking, if you try to authenticate against Entra ID on a mobile device using a private browser session (or even a entra-joined windows device), the device identity is not passed with the request and any CA Policy requiring a "compliant" or "corporate" device will fail Conditional Access policy. You can see this in the sign-in logs in Entra ID where the device ID on the "device info" tab is blank.

Granted device is registered with Entra ID, in a normal browser session, your logic should work. But again, from a security standpoint, this design is not recommended.

What other tip, when you're working with CA Policies, you can use the "What-if" tool to simulate authentication flows with specified conditions to see how your CA Policies would perform:

Answer 1

Hello Choi, Jacky Chun Wing

as Anton already says Private mode doesn´t pass the device, so case 1 and 2 land in your MFA path (read here). in case 3 and 4 Edge on Android can pass device identity.

"View desktop site" changes the user agent Conditional access reads the device plafrom from it (read here).So test case 3 once and check the sign in logs and you will see the Device Info shows the detected OS and Compliance and the Conditional access tab shows which policy applied.

Do your Policies use a device plaform condition or a device filter on deviceOwnership?

if you have no more question please Accept the Answer so others can also find it faster.

Answer 2

Yes, Conditional Access can evaluate device compliance for an Android Enterprise corporate-owned device, but there are important limits for browser scenarios.

For Android Enterprise devices enrolled in Intune, device-based Conditional Access is supported through Intune and Microsoft Entra ID so that only managed and compliant devices can access protected resources.

For Microsoft Edge on iOS and Android, Conditional Access can be used so users access Microsoft 365 content only through Edge, and this configuration also prevents users from using InPrivate to access Microsoft 365 endpoints.

Key points for the scenario:

Compliant device evaluation is supported for managed Android devices Intune compliance policies can mark Android Enterprise devices compliant or noncompliant, and Conditional Access can use that compliance state.
Dedicated device exception If the Android Enterprise device is a dedicated device enrolled without Microsoft Entra shared device mode, users can't sign in to resources protected by Conditional Access policies even if the device is compliant in Intune.
Browser behavior matters For device compliance checks in browsers on iOS, Android, macOS, and some non-Microsoft browsers, Microsoft Entra ID identifies the device by using a client certificate provisioned when the device is registered. The user must select that certificate before continuing.
Edge InPrivate When Edge for iOS and Android is enforced through app-based Conditional Access, the documented behavior is that users are prevented from using InPrivate to access Microsoft 365 endpoints. In that configuration, InPrivate should not be a path that bypasses Conditional Access.

So for an Android Enterprise corporate-owned, Intune-enrolled device using Edge, Conditional Access can use device compliance information to evaluate access. If the access path is governed by the documented Edge mobile Conditional Access configuration, InPrivate access to Microsoft 365 endpoints is prevented rather than treated as a separate compliant browser session.