Block unknown or unsupported device platforms

Description

A Conditional Access policy for All users on All resources blocks access from Any device, excluding only the platforms the organisation supports: {{ allowed_device_platforms }}. Linux, Windows Phone and unknown platforms are then refused unless explicitly allowed.

The policy excludes only the emergency access accounts.

Rationale

Many token theft and password spray tools present user agents that match no supported platform. Blocking them reduces the attack surface and keeps device-based policies from being sidestepped through a platform they do not evaluate.

Impact

Users on a platform that is not listed, for example Linux workstations, are blocked: add it to the parameter if it is supported. The platform condition relies on the user agent, which an attacker can forge: this control complements CB-M365-AUTH-020, it does not replace it.

Applies when

Requires: Microsoft Entra ID P1

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where Users includes All users (only emergency access accounts excluded), Target resources includes All resources, Conditions > Device platforms includes Any device and excludes exactly {{ allowed_device_platforms }}, and Grant is Block access.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Platforms.IncludePlatforms -contains 'all' } | Select-Object DisplayName, State, @{n='Excluded';e={$_.Conditions.Platforms.ExcludePlatforms}}, @{n='Grant';e={$_.GrantControls.BuiltInControls}}
5. Fail if no such policy exists, if it is Report-only or Off, or if it excludes a platform that is not in the list.

Remediation

1. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies and select New policy.
2. Name it, for example ALL - Block unknown platforms.
3. Users > Include: All users. Exclude: the emergency access accounts.
4. Target resources > Resources > Include: All resources.
5. Conditions > Device platforms: Configure Yes, Include Any device, Exclude the platforms in {{ allowed_device_platforms }}.
6. Grant: Block access.
7. Set Enable policy to Report-only, review the sign-in logs for blocked platforms, then switch to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with conditions.platforms.includePlatforms set to all, excludePlatforms set to the list and grantControls.builtInControls set to block.

Rollback

Set the policy to Report-only, or add the missing platform to the exclusions.

References

• Block access for unknown or unsupported device platform Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-020 Require a compliant or hybrid joined device to access resources
• related CB-M365-AUTH-029 Require token protection for desktop access to Exchange Online, SharePoint Online and Teams
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts

People and lifecycle