Care records need a work device

Staff can check their rota from their own laptop or tablet without the young people's records ever opening there. With Care records need a work device on, anyone who signs in with Microsoft on a device your organisation doesn't manage sees only the rota. On a managed device they see everything their role allows, as before.

It needs Microsoft sign-in, because Microsoft is what tells ARC whether the device is managed. The setting appears on the Microsoft sign-in card once your organisation is connected.

Before you switch it on

Your Microsoft admin needs Microsoft Intune and Entra ID P1 or higher, and sets up two things in the Microsoft Entra admin centre:

Under Conditional Access, an authentication context with the ID c1.
A Conditional Access policy, set to On, for All users, that targets that authentication context and grants access only when the device is marked as compliant, with no other way through. Report-only doesn't count, and nor does "Hybrid joined". It can exclude named emergency accounts only, up to five, and not groups, roles or guests.

Try it on one of the home laptops first. It must be enrolled in Intune and compliant, and signed in through a browser that can show Microsoft the device (Edge on Windows, for example). A laptop that fails the check gets only the rota.

Without that policy, Microsoft can still tell ARC the check passed, and everyone would see the full record wherever they are. That's why ARC reads the policy before it lets you switch the rule on.

Switching it on

Open Company Admin, then Company information. On the Microsoft sign-in card, under 5. Work devices, press Check our Microsoft policy and switch on.

You go to Microsoft, where someone who can read Conditional Access signs in: a Global Reader, Security Reader or Conditional Access Administrator. The first time, a Global Administrator has to approve ARC reading your policies. ARC then reads them once and keeps only the policy's name and when it was checked.

If a suitable policy is there, the rule goes on and the card shows when it was checked and which policy it found. If not, the rule stays off and the card says what's wrong.

Anyone already signed in without a work device moves to the rota on their next page, without being signed out. That includes you, unless you're an exempt admin: sign in with Microsoft on a work device to see everything again.

Once it's on, sign in with Microsoft on a personal phone or laptop (one that isn't enrolled) and check you see only the rota.

The checks and changes are recorded in the audit log as Work-device policy checked, Work-device policy check failed and Work-device rule changed.

If your policy changes later

ARC checks the policy only when you press the button. If someone changes or deletes it afterwards, ARC won't know, so press Check again after any change to your Conditional Access policies. If the policy no longer passes, the rule switches off and the card says why. If ARC simply couldn't look (Microsoft was down, or the person signing in can't read policies), nothing changes.

If it has been more than 30 days since the last check, the card asks you to press Check again. The rule stays on until you do.

If the policy leaves out named people (often emergency admin accounts), the card tells you how many. They can open the full record on any device, so check nobody else is left out.

If Microsoft sign-in is set to Off and back on while the rule is set, anyone already signed in without a work device moves to the rota, as when the rule first goes on.

Who it does not reach

Exempt admins. The one or two admins who keep the email code are never held to it.
Anyone signing in with an email code or password. While Microsoft sign-in is Allowed, people can choose the email code instead and see the full record on any device. Set Microsoft sign-in to Required to close that. Someone kept signed in by "Remember me", or joining from an invite, sees only the rota until they sign in with Microsoft on a work device.
People whose ARC email is not on one of your approved domains. They keep the email code even under Required, so the card lists them under Cannot sign in with Microsoft. Change their email in ARC to their work address to bring them under the rule.

Staff who only ever need the rota

Bank or relief staff who should never see records don't need this setting: give them a staff profile and no homes. See Set up shifts and rota settings.