Merge pull request #16229 from ErikjeMS/win365b

freshness

Author: garycentric

windows-365/enterprise/media/restrict-office-365-cloud-pcs/create-conditional-policy.png

@@ -7,7 +7,7 @@ keywords:
 author: ErikjeMS  
 ms.author: erikje
 manager: dougeby
-ms.date: 09/27/2023
+ms.date: 09/30/2024
 ms.topic: how-to
 ms.service: windows-365
 ms.subservice: windows-365-enterprise
@@ -36,31 +36,42 @@ Administrators can deny access to Office 365 services on any device other than a
 This article describes how to limit access to Office 365 services. You can use the same strategy with any cloud service that uses Microsoft Entra ID as the authentication source.
 
 1. Create a Microsoft Entra security group to manage which users are controlled by the new policy. Add to this group all the Cloud PC users who will be subjected to the new policy. Only users in this group will be restricted to using Cloud PCs when accessing Office 365 services. If you want to change a user’s access, you can just remove them from this group.
+
 2. Sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Endpoint security** > **Conditional access** > **Create new policy**.
+
     ![Create conditional access policy screen shot](./media/restrict-office-365-cloud-pcs/create-conditional-policy.png)
+
 3. Type a **Name** for your new Conditional Access policy. For example, “Restrict Office 365 access to CPCs”.
+
 4. Select **0 users and groups selected** > **Include** > **Select users and groups** > **Users and groups** > select the Microsoft Entra security group that you created > **Select**.
+
     ![Select group screen shot](./media/restrict-office-365-cloud-pcs/select-group.png)
-5. Select **No cloud apps, actions, or authentication contexts selected** > **Include** > **Select apps** > **None** (under **Select**) > search for and select **Office 365** > **Select**.
+
+5. Select **No target resources selected** > **Include** > **Select apps** > **None** (under **Select**) > search for and select **Office 365** > **Select**.
+
     ![Select apps to include](./media/restrict-office-365-cloud-pcs/include-apps.png)
+
 6. Select **Exclude** > **None** (under **Select excluded cloud apps**) > search for and select **Azure Virtual Desktop** and **Windows 365** apps > **Select**.
-    ![Select apps to exclude](./media/restrict-office-365-cloud-pcs/exclude-apps.png)
-7. Select **0 conditions selected** > **Not configured** (under **Filter for devices**).
-    ![Filter devices screen shot](./media/restrict-office-365-cloud-pcs/filter-devices.png)
+
+7. Select **0 conditions selected** (under **Conditions**) > **Not configured** (under **Filter for devices**).
+
 8. In the **Filter for devices** pane:
+
     1. Set **Configure** to **Yes**.
     2. Select **Exclude filtered devices from policy**.
     3. Select the dropdown option under **Property** > **Model**.
     4. Select the dropdown option under **Operator** > **Starts with**.
     5. In the text box under **Value**, type the value as **Cloud PC**. If the Cloud PC naming conventions change, change the filter value to match the device names.
     6. Select **Done** to set the filter.
 
-   ![Configure filtering devices](./media/restrict-office-365-cloud-pcs/filter-devices-configure.png)
+    ![Configure filtering devices](./media/restrict-office-365-cloud-pcs/filter-devices-configure.png)
 
     You can set more options in this policy as needed, but such additions are outside the scope of this article.
+
 9. Select **0 controls selected** (under **Grant**) > **Block Access** >**Select**.
-    ![Block access screen shot](./media/restrict-office-365-cloud-pcs/block-access.png)
+
 10. Select **On** (under **Enable policy**). This policy will restrict users from accessing Office 365 services on non-Cloud PC devices. You may want to select **Report-only** to monitor the policy and build confidence prior to enforcing it.
+
 11. Select **Create** to complete the creation of policy.
 
 >[!NOTE]