Lets a Conditional Access policy target or leave out machines based on a rule over their properties, such as operatingSystem or extensionAttribute1. It takes over from the retired device state condition. Note that unregistered machines are only caught by negative operators.
Also called Device state.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Filter for devices in context, with comparison tables and the common traps.
Terms in this definition
- Conditional Access
Policy engine in Microsoft Entra ID P1 that, depending on signals such as risk or named locations, allows access subject to controls like MFA or a compliant device, or blocks it.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- OVER
Gives a T-SQL window function its window: PARTITION BY, ORDER BY and, if wanted, a ROWS or RANGE frame. Rankings and running totals can then be worked out while every row is kept.