Extremely long story short we had two successful phishing attempts at the beginning of the year. Both were caught within 15 minutes (Thanks Barracuda Sentinel!) but both users still emailed out junk. In both cases our Barracuda spam filter kicked in it's spam prevention so only the first 100 emails went out in both cases and we were able to kill the rest but it still happened. Since then we have switched all our users to MFA using either Microsoft Authenticator, Google Authenticator, or a Yubi Key. We have updated our password policy to 10+ characters and set to never expire. We have also Intune enrolled every computer. Now we are working on managing every mobile device and are at 50% so far with everyone being told they have until the end of October to complete this or they will lose access to all company resources using their mobile. We are 80% company supplied mobile device, 20% personal, but we made no exceptions on this policy and because of the two breaches management is 100% on board with this change. Anyone that says no that has a personal device is being offered a company supplied device (no one has taken us up on that so far). Currently I have the default policies enabled: * Block access for unknown or unsupported device platform * Block legacy authentication * Require multifactor authentication for admins I also have the default "Require multifactor authentication for all users" in Report-Only mode and have been watching for any failures and that will also probably be enabled. So here is where I'm stuck. I want to make it so only registered (hybrid-joined) and managed (Intune) device can access anything. I want to make sure if someone clicks a link and logins in that session hijacking can't be used and bypass MFA. BUT we also work in a field where we have field technicians that need to remotely access our SharePoint where there is a bunch of software to download and they do this from customer machines that do not have USB enabled. Like the IT staff at these locations tell them they have internet access but no removable drive access. So they log into our SharePoint, download the software they need, and install it. And usually forget to log out. So how do I lock everything down BUT allow non-managed access to SharePoint and still keep it secure. Like maybe have it non-persistent and force MFA every time? It's usually the same group of 40 people but I don't want to just exclude them from the main managed device policy.