Android Personal Devices enrollment in Microsoft Intune

Hi,

I want to enroll Android personal devices for my employees who use their phones to access company data like teams and mails. I need that even those who are already access outlook mobile with unmanaged devices be forced to enroll them before they access my company data.

I have tried the following.

Created managed google play account

Turned on automatic enrollment

Turned on: Personal and corporate-owned devices with device administrator privileges

Created a device platform restriction policy which pointed to dynamic device group

Created a compliance policy blocking rooted devices and requiring a password to access company apps

Created a Conditional Access policy in Entra ID which requires devices to be marked as compliant before accessing any cloud app. This policy is pointing to a dynamic device group. I had first assigned it to all users, but it didn't work out.

With the above settings, devices can enroll but even those which are not enrolled still have access to the cloud apps.

How can I force those unmanaged devices not to access the company mails and teams, and then prompt them to download a company portal app and enroll their BYOD/Personal devices?

NB: I have achieved the above on iOS but Androids failed

Please advise me.