What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Unsupported devices do not automatically bypass Microsoft Entra Conditional Access. Access can slip through when a policy omits unsupported platforms, relies on a platform signal that can be changed, uses a device filter that cannot match an unregistered device, or expects a sign-in flow to provide device state when it cannot. Treat these as policy-coverage and signal limitations—not proof that every unsupported device can get in.
What “unsupported device” means for Conditional Access
Microsoft lists Android, iOS, Windows, macOS, and Linux as device-platform categories for Conditional Access. Its guidance uses Chrome OS as an example of an unsupported platform that organizations may need to cover separately. “Unsupported” here refers to a platform outside the categories or support scope being used in a particular policy; it does not mean every device on that platform is untrusted or automatically allowed.
A Conditional Access outcome depends on the policy’s assignments and conditions as well as other policies that apply. Microsoft says all applicable policies must be satisfied. A gap in one device-control policy therefore is not, by itself, evidence that the sign-in will succeed. See Microsoft’s device-platform condition guidance and overview of Conditional Access policies.
How unsupported devices can appear to bypass a policy
An unsupported platform is outside the policy’s scope
A policy built around the platforms an organization recognizes may not cover an unsupported or unknown platform unless that platform is explicitly included in policy scope. Microsoft’s documented pattern is to target any device, exclude the supported platforms the organization actually uses, and block access for the remaining devices. If an organization excludes a platform it does not actually use, the policy can leave a gap rather than close one.
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
This is a coverage problem, not a special bypass mechanism in Conditional Access. The policy’s user assignments, target resources, exclusions, client-app conditions, and the rest of the applicable policy set still affect the result. Microsoft provides the unsupported-device-platform policy pattern.
The platform signal can be changed
Conditional Access derives platform information from signals supplied by the device, including its user-agent string. Microsoft warns that this information is not verified because user-agent strings can be modified. A request could therefore present a different platform signal and receive different treatment from a platform-scoped policy. That possibility does not establish that a changed signal will succeed: other policy conditions and controls may still block access.
Rank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
For this reason, treat the platform condition as a way to scope policy—not as proof that a device is genuine, managed, or trustworthy. Microsoft recommends pairing it with stronger controls, such as a compliance or app-protection requirement, or using it as part of a block policy. See Microsoft’s explanation of Conditional Access conditions.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A filter cannot match attributes that are absent
Device filters evaluate attributes on registered devices. An unregistered device has no Entra device object, so its device attributes are treated as null. A positive comparison—such as matching a known value—cannot identify an attribute that is absent. Microsoft recommends using a negative operator when the goal is to target unregistered devices, because the filter rule can then apply when those attributes are missing.
Rank #3
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Review both the filter operator and its behavior for registered and unregistered devices; do not assume that a filter mentioning a device attribute automatically catches unknown devices. Microsoft explains the null-value behavior and operator choice in its device-filter documentation.
A sign-in flow may not supply the device state the policy requires
In the device-code OAuth flow, one device performs authentication while a separate device presents the code. Microsoft documents that the authenticating device cannot transfer its device state to the device presenting the code, and that a managed-device grant or device-state condition is unsupported for this flow. Account for this limitation when designing access requirements; it applies to this flow and should not be generalized to every authentication method.
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
See Microsoft’s grant-control guidance for the documented flow limitation.
Grant controls or policy assignments differ from what an administrator expects
Within a policy, multiple grant controls are all required by default unless the administrator selects an “require one” arrangement. Across policies, all applicable policies must be satisfied. A policy with alternative grants, an unexpected exclusion, or an assignment that does not include the intended users or resources can therefore behave differently from an administrator’s mental model. Inspect assignments and grant logic alongside the device signal, rather than treating a platform condition as the whole decision.
Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
How to close the coverage gap safely
- Define the platforms you actually support. Compare your organization’s supported platforms with Microsoft’s listed categories: Android, iOS, Windows, macOS, and Linux. Decide which categories are in use and whether unsupported or unknown platforms should be blocked for the resources in scope. Do not create exclusions for platforms merely because they appear in a template.
- Build explicit unsupported-platform coverage. Follow Microsoft’s pattern: include any device, exclude only the supported platforms your organization uses, and set the grant control to block access for what remains. Exclude emergency-access accounts as Microsoft recommends to reduce lockout risk. Start in report-only mode, assess the impact, and enable the policy only after reviewing the results. The Microsoft policy example describes this approach.
- Use device trust controls for the decision that needs device trust. Where appropriate, pair platform scoping with a device-compliance or app-protection requirement rather than treating the platform label as proof of trust. Verify that the relevant endpoints and applications meet the prerequisites for the control; Microsoft notes that compliance requirements have platform and enrollment prerequisites.
- Test device-filter behavior for both registered and unregistered devices. Check the filter mode, the attributes used, and whether the selected operator behaves as intended when attributes are null. Use Microsoft’s filter guidance to validate the logic.
- Review the full policy decision. Check user and workload scope, target resources, client apps, platform conditions, exclusions, and whether grants require all controls or one. Microsoft says user-scoped Conditional Access policies do not block service-principal calls; assess workload identities separately.
- Validate before broad enforcement. Use report-only results and policy-impact checks before enabling a block policy. For token-protection deployment specifically, Microsoft recommends piloting, reviewing interactive and non-interactive sign-in logs, and blocking unknown platforms. Token protection is currently limited to Windows and Apple devices in that deployment guidance; that limitation is specific to token protection, not a general limit on all Conditional Access controls. Consult the token-protection deployment guide for that scope.
What to conclude from a suspected bypass
A sign-in from an unsupported platform is a reason to investigate policy coverage and the evidence available for that sign-in—not enough on its own to conclude that Conditional Access was bypassed. Determine which policies applied, whether the device was registered, what platform signal was evaluated, and whether the authentication flow could provide the device state the policy expected. Then correct the specific scope or control gap and validate the change in report-only results before enforcing it broadly.
Microsoft’s documentation may change. Check the linked platform, filter, grant-control, and deployment guidance when designing or enforcing policies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
