# All sign-in activity comes from managed devices
Requiring sign-ins from managed devices ensures that users access organizational resources only from devices that meet your security and compliance…
Source: https://maester.dev/docs/tests/ZTA.21892
## Overview
Requiring sign-ins from managed devices ensures that users access organizational resources only from devices that meet your security and compliance requirements. Unmanaged devices lack organizational security controls and endpoint protection, creating potential entry points for attackers. Using Conditional Access to require compliant or Microsoft Entra hybrid joined devices helps protect against credential theft and unauthorized access from untrusted endpoints.
## Remediation
- [Require compliant or hybrid joined devices with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-compliance?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Configure device compliance policies in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | High |
| Impact on users | High |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Conditional Access |
| Area | Access control |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.