Microsoft is rolling out new device state conditions to Azure Active Directory conditional access to allow excluding hybrid Azure AD joined devices and compliant devices from policies.