Does Conditional Access for Workload Identities apply to Service Principal authentication used by Azure SDK or Terraform via environment variables?

Question

Does Conditional Access for Workload Identities apply to Service Principal authentication used by Azure SDK or Terraform via environment variables?

U R 20

In Microsoft Entra, Conditional Access policies allow you to restrict user account logins to the Portal and logins via Azure CLI/Azure PowerShell based on location or IP address.

Additionally, Conditional Access for Workload Identities allows you to restrict logins using service principals via Azure CLI/Azure PowerShell based on location or IP address.

Based on this, I have a question.

When authenticating with Azure SDKs or Infrastructure-as-Code (IaC) tools in Azure using a service principal configured through environment variables, will Conditional Access for Workload Identities also be applied?

Azure SDK: https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/on-premises-apps?tabs=azure-portal%2Cwindows%2Ccommand-line#3---configure-environment-variables-for-application

Authentication for Azure IaC tools: https://learn.microsoft.com/en-us/azure/developer/terraform/authenticate-to-azure-with-service-principle?tabs=azure-powershell#specify-service-principal-credentials

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-03-24T08:25:27.7533333+00:00

U R I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance. I’m happy to help

1 answer

Your answer

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-03-24T08:25:27.7533333+00:00

U R I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance. I’m happy to help

Answer 1

VEMULA SRISAI 13,890 Microsoft External Staff Moderator

Hello U R,

Yes. Conditional Access for Workload Identities is evaluated at token issuance time in Microsoft Entra ID, not based on the client used.

So if Azure SDKs or IaC tools like Terraform authenticate using a service principal via environment variables, the sign‑in is treated as a service principal (workload identity) sign‑in, and any Conditional Access policies scoped to Workload identities (for example, IP/location‑based blocking or service principal risk) will be applied.

The authentication method (CLI, SDK, Terraform, env vars, etc.) does not bypass Conditional Access—as long as the policy is directly assigned to the service principal and you have Entra Workload ID Premium, enforcement occurs.

Note: Managed identities are excluded from Conditional Access for workload identities; this applies only to service principals.

For your reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity

U R 20 Reputation points

2026-03-16T06:41:59.3833333+00:00

Hi VEMULA SRISAI
Thank you.

My understanding is that Conditional Access for Workload Identities is applied when a service principal requests a token during authentication. Therefore, since a token is requested even when authentication is performed using environment variables, the Conditional Access policy would still be applied. Is my understanding correct?

I also have an additional question.

https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/local-development-dev-accounts?tabs=azure-portal%2Csign-in-visual-studio

When using Azure SDK authentication, a developer account may be used. In that case, when authenticating via CLI (az login) or PowerShell (Connect-AzAccount), I assume that regular Conditional Access policies will be applied, and the authentication will not complete if the access conditions are not met.

For other authentication methods, such as through Visual Studio Code or Visual Studio, I believe the authentication process is slightly different from CLI or PowerShell.

In those cases as well, will Conditional Access still be applied and enforce access restrictions?
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-03-16T07:02:05.65+00:00

U R Yes, your understanding is correct.

Conditional Access (CA) for Workload Identities is evaluated when Microsoft Entra ID issues a token to a service principal. Since Azure SDKs and IaC tools (like Terraform) using environment variables still request tokens from Entra ID using the service principal, Conditional Access policies scoped to Workload Identities are applied regardless of how the credentials are supplied (env vars, config files, SDK, etc.).

Regarding developer (user) authentication with Azure SDKs

You are also correct here.

When Azure SDK authentication uses a developer account (user identity):

CLI (az login) and PowerShell (Connect-AzAccount) These are standard user interactive sign-ins, so regular user-based Conditional Access policies are fully enforced. If MFA, device compliance, location, or any other CA requirement isn’t met, authentication will fail.

Visual Studio Code / Visual Studio authentication Even though the sign-in flow may look different (brokered sign-in, embedded browser, system browser, etc.), the authentication still results in a user token issued by Microsoft Entra ID. Because of that, the same user-based Conditional Access policies are enforced (MFA, compliant device, location restrictions, sign-in risk, etc.).
U R 20 Reputation points

2026-03-16T07:28:14.1866667+00:00

Hi VEMULA SRISAI

Thank you.

My understanding is that Entra Conditional Access policies apply to any authentication method as long as the user is managed in Entra ID, and therefore it is not possible to bypass these policies. Is that correct?

Also, is my understanding correct that Managed Identities are not subject to user-based Conditional Access policies or workload identity Conditional Access policies, and that IP restrictions cannot be enforced when authentication is performed using a Managed Identity, even through other methods?
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-03-16T07:45:16.2166667+00:00
U R Yes, your understanding is correct, with the following clarifications.

Conditional Access and “bypassing” authentication

Conditional Access in Microsoft Entra is evaluated when a token is issued. As long as an identity (user or service principal) is managed by Entra ID and the sign‑in goes through Entra ID token issuance, Conditional Access policies are always enforced. Changing the authentication method (CLI, SDK, PowerShell, Visual Studio, VS Code, environment variables, etc.) does not allow Conditional Access to be bypassed.

So:

User identities → User‑based Conditional Access always applies

Service principals → Conditional Access for Workload Identities applies

The client or tool used does not affect enforcement
Managed Identities and Conditional Access

Your understanding here is also correct.

Managed Identities are not subject to:

User‑based Conditional Access policies

Conditional Access for Workload Identities policies

This is by design. Managed identities obtain tokens from the Azure Instance Metadata Service (IMDS), not through an Entra ID sign‑in flow that Conditional Access can evaluate. Because of this:

IP/location‑based Conditional Access cannot be enforced

MFA, device compliance, and sign‑in risk policies do not apply

Enforcement instead relies on Azure RBAC, resource boundaries, and network controls (VNet isolation, Private Endpoints, firewalls, etc.)

Even if the code using the managed identity runs from different locations or tools, Conditional Access is still not evaluated.
U R 20 Reputation points

2026-03-16T08:24:59.1233333+00:00

Hi **VEMULA SRISAI
**
Sorry for asking again.

With Conditional Access, it is possible to enforce restrictions before sign-in. However, after sign-in, is it possible to restrict resource operations based on the IP address?

As a premise, sign-in is already restricted by Conditional Access, so access by Entra-managed users from unauthorized IP addresses is not allowed.

Given that, is it currently not possible to restrict resource operations based on IP address for specific users after they have signed in?
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2026-03-20T08:29:31.44+00:00

U R Conditional Access in Microsoft Entra ID is evaluated only during sign‑in or token issuance. Once a user successfully authenticates and obtains a valid token, Entra ID does not re‑evaluate IP address or location for each Azure Portal or ARM (management‑plane) operation. Therefore, it is not possible to restrict Azure management‑plane actions by IP address after sign‑in using Conditional Access or Azure RBAC.

To enforce IP‑based restrictions after authentication, the solution is to apply controls at the resource or network level, such as service firewalls, access restrictions, Private Endpoints, or VNet isolation. Azure Policy can be used to audit or enforce these network configurations across resources to ensure consistent enforcement.

Does Conditional Access for Workload Identities apply to Service Principal authentication used by Azure SDK or Terraform via environment variables?

1 answer

Conditional Access and “bypassing” authentication

Managed Identities and Conditional Access

Your answer