Solved. Thanks.

CA-Assignments
include all users, except bg
include devices: android, ios
exclude device filter: device.operatingSystem -eq "AndroidForWork"
CA-Access Control
Grant, but compliance and app protect-policy required

🙏🏻

Check.

Grant, but require: App Policy & Compliant Device

However, the devices are compliant too if a user logs into Teams within the private and not work profile on their company-managed device.

How can I filter between private and work profiles?
device.operatingSystem -eq "AndroidForWork"

The link you posted isn't public?

Job done! 🤘🏻

Thanks! I often see BLOCK to not allow access with any computer outside any trusted network. It seems like everybody searches for a deny all rule from the concept of firewalls.

Yes! 🙌 Crazy new Social media PROMPT! 😂

Confirmed! 😂

I did! 😂👆

@luisefreese.bsky.social but how can we mention some other? :O

Great Work! Thanks!

Perfect map! Thanks!