Block Cloud Apps Sign In from Non-Azure AD Joined Devices

To block cloud apps signing in from non-Azure AD joined devices, please refer to the instructions below,

1. Under Azure Active Directory Admin Center, go to Conditional Access --> Click New policy drop-down button --> click on Create new policy 

2. Under Name, enter the appropriate name for the policy

3. Under Assignments,

• Select required users or workloads

Note: It is highly recommended to test conditional access policies with specific users or groups utilizing all the features in the organization and gradually roll them out to the entire organization

• Include/exclude required Cloud apps
• Select Filter for devices under the Conditions and configure it as shown in the image below and click Done

4. Under Access controls,

• Select Block access under Grant

Click create and test the policy

Note: Please refer to articles below for more info

Plan an Azure Active Directory Conditional Access Deployment | Microsoft Docs

Filter for devices as a condition in Conditional Access policy - Azure Active Directory | Microsoft Docs