Endpoint Compliance & Conditional Access Case Study

An endpoint compliance and Conditional Access program for a regulated U.S. FinTech — Jamf Pro device compliance feeding Microsoft Entra ID so one policy set governs Mac and Windows access, aligned to SOC 2.

The problem

In a regulated FinTech, “are our endpoints secure?” is a question auditors ask in writing, and the answer has to be a number backed by evidence. The fleet spanned macOS, Windows, iOS, and ChromeOS. Windows compliance was reasonably well covered by Intune, but Macs sat outside the same enforcement — managed by Jamf, but not gating access to corporate data through the same rules. Encryption, patch state, and security-agent health were tracked in two places with two definitions of “compliant,” and pulling an audit-ready report meant manual work every quarter.

Approach

Write the standard before touching a console. One document defining what “compliant” means for every platform — disk encryption on with an escrowed recovery key, OS within a defined window of current, firewall enabled, security agent healthy, screen lock enforced — mapped directly to the SOC 2 controls it satisfies.
Express the standard as policy on both platforms. Intune compliance policies for Windows and mobile. On the Mac side, a Jamf Smart Group for the compliance baseline plus the Jamf Pro Conditional Access connection so Jamf’s compliance verdict is visible to Entra ID.
Build one Conditional Access policy. For all users, accessing all cloud apps, require the device to be marked compliant or Entra hybrid joined — covering Windows via Intune and macOS via Jamf under a single rule, with MFA and sign-in-risk conditions layered on top.
Prove it before enforcing it. Report-only mode for two weeks, reading the workbook daily, fixing every user the policy would have blocked, and confirming break-glass accounts were excluded from every policy.
Make the report a button, not a project. A Graph API job that exports compliance state, encryption-with-valid-key percentage, and time-to-patch against the standard — the exact evidence the audit asks for.

What I built

A written, control-mapped compliance standard covering four platforms.
Jamf Smart Groups and Intune compliance policies that continuously evaluate every device against that standard.
The Jamf–Intune connector wired into Entra ID, and a single device-based Conditional Access policy governing Mac and Windows access identically.
App protection policies (MAM) for managed and unmanaged mobile devices — DLP, selective wipe, managed app configuration, and app-based Conditional Access so only compliant apps reach corporate resources.
Automated FileVault and BitLocker enforcement with recovery-key escrow, and reporting on “encrypted with a valid escrowed key,” not just the encryption flag.
A Graph-API compliance dashboard producing audit evidence on demand.

Results

One definition of compliant across the fleet, enforced by one Conditional Access policy — a non-compliant Mac loses access to Microsoft 365 through the same rule as a non-compliant PC.
Quarterly audit prep for endpoint controls went from a manual data-gathering exercise to running a report.
Encryption reporting shifted from “% encrypted” to “% encrypted with a recoverable key we hold” — closing the gap that turns a lost laptop into an incident.
The report-only rollout meant enforcement went live without a flood of lockout tickets.

What I’d tell someone starting this

Conditional Access is where all the compliance work finally matters — and it’s also where you can lock your whole company out in one save. Write the standard first and map it to your framework’s controls, so every technical decision has a justification. Prove the policy in report-only. Exclude break-glass accounts from everything. And report against the standard, in the framework’s language, not in raw version numbers — that’s what makes the auditor’s job (and yours) short.

← All projects · Discuss a compliance program