---
title: "Scalefusion Device Attestation and Baseline Scopes Compatibility"
slug: "baseline-scopes-conditional-access-intune-partner-compliance"
updated: 2026-09-03T10:10:19Z
published: 2026-09-03T10:10:19Z
canonical: "help.scalefusion.com/baseline-scopes-conditional-access-intune-partner-compliance"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scalefusion Device Attestation and Baseline Scopes Compatibility

## 

As of June 15, Microsoft updated how Conditional Access policies targeting **All Resources/All Applications** handle baseline scopes.

Previously, when an application was excluded from an All Resources policy, baseline scopes such as [**User.Read**](http://User.Read) were also excluded from Conditional Access evaluation. With this update, baseline scopes are now treated as directory access and are evaluated against Conditional Access policies, even if the application itself is added to the exclusion list.

In the case of **Scalefusion Intune Partner Compliance**, the **Scalefusion Device Attestation** application requests the [**User.Read**](http://User.Read) baseline scope. Therefore, even when the application is excluded from the Conditional Access policy, the request is evaluated as access to the **Windows Azure Active Directory** resource and can be blocked by the policy.

To ensure the Intune Partner Compliance integration and Scalefusion Device Attestation work correctly with Conditional Access policies targeting **All Resources**, IT administrators must make the following changes:

1. **Login** to [https://entra.microsoft.com/](https://entra.microsoft.com/)

### Step 1: Registering a New Application

1. Navigate to the the **App Registrations** page and follow the instructions below
  1. Register a new App by clicking on the **New Registration** option![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/baseline-scopes-conditional-access--intune-partner-compliance-image-nsg2clqd.png)
  2. Enter a name for the **Application** and click **Register** **Application Name:** Scalefusion Device Attestation Companion

**Account Types:** Single tenant only![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/baseline-scopes-conditional-access--intune-partner-compliance-image-nj53s834.png)
  3. Once the application is created, navigate to the **API Permissions** section of the newly created application and remove the **User.Read** permission.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/baseline-scopes-conditional-access--intune-partner-compliance-image-9j349g6e.png)

### Step 2: Updating the Baseline Scopes Configuration

1. Now navigate to the newly added section of **Baseline Scopes** using the link [https://aka.ms/BaselineScopesSettingsUX](https://aka.ms/BaselineScopesSettingsUX) or clicking on **Conditional Access → Baseline Scopes**

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/baseline-scopes-conditional-access--intune-partner-compliance-image-0zrqmgwy.png)

1. From the enforcement policies select **Customize Behavior**

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/baseline-scopes-conditional-access--intune-partner-compliance-image-o6dtrsr9.png)

1. Search for the newly registered app **Scalefusion Device Attestation Companion** app and after **selecting it (checkbox)** click **Select** **Note**: If the app is not getting displayed while searching, then scroll down to **Scalefusion Device Attestation Companion** app

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-PXYMIPRD.png)

1. Click **Save** on the **Baseline Scopes** configuration screen

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-LRZAG1H7.png)

1. Click on Change Target resource on the “Change the target resource for baseline scopes? “ popup window.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/baseline-scopes-conditional-access--intune-partner-compliance-image-pgqm0fgg.png)

### Step 3: Updating the Conditional Access Policies

For each Conditional Access Policy that applies to the users which are added as Targets for Scalefusion Intune Partner Compliance, add the **Scalefusion Device Attestation Companion** as an exclusion. The steps here demonstrate exclusion in one policy.

1. Navigate to the **Conditional Access Policies → Policy created for Scalefusion Intune Compliance** and edit each policy that targets the user,

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-R3R7R5NI.png)

1. Navigate to Target Resources → Exclude. Click on **Select specific resources** and the newly created app **Scalefusion Device Attestation Companion**

a. Search for **Scalefusion Device Attestation Companion**

b. Click on the **Checkbox** so that the app gets added to the **Selected** section

c. Click on the **Select**

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-WP4V79MY.png)
2. Once the application has been added to the exclusion, verify that all 3 Scalefusion applications are in the exclusion list.
  1. a. Scalefusion
  2. b. Scalefusion Device Attestation
  3. c. Scalefusion Device Attestation Companion

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1PJGB9U4.png)

1. Enable the Policy and Click on the **Save** at the bottom of the form/wizard to save the updates to conditional access policies.