To enable Single Sign-On (SSO) for a third-party application from the Azure AD gallery, you must add it to your tenant. This process creates an enterprise application (a service principal object). This enterprise application represents the service in your tenant and is the object you configure for SSO. When users are already signed into their Azure AD-joined computers, Azure AD can then issue access tokens for this application without requiring users to re-enter their credentials.

Conditional Access policies are the primary tool in Azure AD for enforcing organizational access rules. To restrict access to a specific application based on the device's status, you would create a Conditional Access policy. This policy would target the "Service1" enterprise application and include a grant control that requires the connecting device to be Azure AD-joined, thereby blocking access from any device that does not meet this condition.

Microsoft Azure Active Directory Documentation, "What is application management in Azure Active Directory?": This document clarifies that an application added from the gallery to a tenant for SSO is represented as an "enterprise application." It states, "An enterprise application is an object in your Azure AD tenant that represents an application that has been configured for single sign-on." (learn.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-application-management)

Microsoft Azure Active Directory Documentation, "What is Conditional Access?": This source defines Conditional Access as the tool used by Azure AD to bring signals together, to make decisions, and enforce organizational policies. It explicitly lists "device state" as a common signal. (learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview)

Microsoft Azure Active Directory Documentation, "Conditional Access: Conditions": This document details the specific conditions available for policies. The "Device platforms" and "Device state (deprecated)" conditions, along with grant controls like "Require Hybrid Azure AD joined device," demonstrate how Conditional Access is used to enforce device-based restrictions. (learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions)