Merge pull request #105155 from MicrosoftGuyJFlo/CAControlsUpdate

[Azure AD] Conditional Access - Conditions update

Author: PRMerger16

articles/active-directory/conditional-access/concept-conditional-access-grant.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: conditional-access
 ms.topic: conceptual
-ms.date: 02/11/2020
+ms.date: 02/21/2020
 
 ms.author: joflore
 author: MicrosoftGuyJFlo
@@ -52,13 +52,17 @@ Selecting this checkbox will require users to perform Azure Multi-Factor Authent
 
 Organizations who have deployed Microsoft Intune can use the information returned from their devices to identify devices that meet specific compliance requirements. This policy compliance information is forwarded from Intune to Azure AD where Conditional Access can make decisions to grant or block access to resources. For more information about compliance policies, see the article [Set rules on devices to allow access to resources in your organization using Intune](https://docs.microsoft.com/intune/protect/device-compliance-get-started).
 
+A device can be marked as compliant by Intune (for any device OS) or by third-party MDM system for Windows 10 devices. Third-party MDM systems for device OS types other than Windows 10 are not supported.
+
+Devices must be registered in Azure AD before they can be marked as compliant. More information about device registration can be found in the article, [What is a device identity](../devices/overview.md).
+
 ### Require hybrid Azure AD joined device
 
 Organizations can choose to use the device identity as part of their Conditional Access policy. Organizations can require that devices are hybrid Azure AD joined using this checkbox. For more information about device identities, see the article [What is a device identity?](../devices/overview.md).
 
 ### Require approved client app
 
-Organizations can require that an access attempt to the selected cloud apps needs to be made from an approved client app.
+Organizations can require that an access attempt to the selected cloud apps needs to be made from an approved client app. These approved client aps support [Intune app protection policies](/intune/app-protection-policy) independent of any mobile-device management (MDM) solution.
 
 This setting applies to the following client apps:
 
@@ -99,9 +103,7 @@ This setting applies to the following client apps:
 
 ### Require app protection policy
 
-In your Conditional Access policy, you can require an app protection policy be present on the client app before access is available to the selected cloud apps. 
-
-![Control access with app protection policy](./media/technical-reference/22.png)
+In your Conditional Access policy, you can require an [Intune app protection policy](/intune/app-protection-policy) be present on the client app before access is available to the selected cloud apps. 
 
 This setting applies to the following client apps:
 
@@ -116,6 +118,10 @@ This setting applies to the following client apps:
 - The **Require app protection policy** requirements:
     - Only supports the iOS and Android for device platform condition.
 
+### Terms of use
+
+If your organization has created terms of use, additional options may be visible under grant controls. These options allow administrators to require acknowledgment of terms of use as a condition of accessing the resources protected by the policy. More information about terms of use can be found in the article, [Azure Active Directory terms of use](terms-of-use.md).
+
 ## Next steps
 
 - [Conditional Access: Session controls](concept-conditional-access-session.md)