Entra Conditional Access Policy not applied to admin.cloud.microsoft

Question

Entra Conditional Access Policy not applied to admin.cloud.microsoft

John Percival 0

You can use https://admin.cloud.microsoft/ or https://admin.microsoft.com/ to access the Microsoft 365 Admin Portal.

I have a conditional access policy applied to Microsoft Admin Portals (and also Microsoft 365 Admin portal)

This policy specifies a sign-in frequency of ever 6 hours.

All users are included.

It is applied successfully on https://admin.microsoft.com/

It is not applied on https://admin.cloud.microsoft/

I don't think I have misconfigured anything, so I am beginning to wonder if this is a (fairly serious) problem with MS CA policy coverage.

Edit 20 Aug 2025: here are the sign in logs:

When I access via admin.cloud.microsoft, the sign-in log shows success, CA not applied, and:

Application: Office365 Shell WCSS-Client
Application ID: 89bee1f7-5e6e-4d8a-9f3d-ecd601259da7
Resource: Microsoft Graph
Resource ID: 00000003-0000-0000-c000-000000000000

When I access via admin.microsoft.com, the sign-in log shows failure, CA applied successfully, and:

Application: Microsoft Office 365 Portal
Application ID: 00000006-0000-0ff1-ce00-000000000000
Resource: Windows Azure Active Directory
Resource ID: 00000002-0000-0000-c000-000000000000
Sign-in error code: 70044
Failure reason: The session has expired or is invalid due to sign-in frequency checks by conditional access.

0 comments

3 answers

Your answer

Answer 1

John Percival 0

Hello, is anyone able to help me make some progress on this?

0 comments

Answer 2

Andy David - MVP 160.2K MVP Volunteer Moderator

The issue is the target resource which is graph and not the portal itself. CA Policies target the service, not the ap requesting it, the way to ensure its requiring MFA is to require MFA for all resources:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#all-resources

Note that Microsoft is also enforcing MFA on portals as well:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet

John Percival 0 Reputation points

2025-08-20T06:16:19.4533333+00:00

Thanks Andy for offering a response.

The CA policy that is causing problems is a session-length policy, which we want to apply to all the admin portals, so we have selected "Microsoft Admin Portals".

The issue is that admin.cloud.microsoft is displaying different behaviour to admin.microsoft.com despite both displaying the same page, allowing the same actions (such as giving someone a new admin role) and both being "Microsoft Admin Portals".

I am becoming increasingly concerned that admin.cloud.microsoft is not being included as one of the URLs for "Microsoft Admin Portals" for whatever reason, and so is not covered by the CA policy.

I just can't seem to get through to the right department in Microsoft to raise what looks increasingly to me to be a serious security issue.

Are you able to replicate this issue? Would you like me to do a video call to show you? Can you help me connect to someone in Microsoft who can address this? Thanks so much

Answer 3

vallepu aravind 75

I hope you have checked the audit logs for that account, please check your can get better idea,is it bypass the conditional access or not ,if your configuration correct and both url navigate to admin center only , please check in different browser.thanks

John Percival 0 Reputation points

2025-08-19T15:55:02.0166667+00:00

Thanks, I have tried on Windows PC and Android device. Same behaviour in both, as described above.

I have added the sign-in logs to the OP.

Any suggestions as to why it is not being applied to admin.cloud.microsoft?

Share via

Entra Conditional Access Policy not applied to admin.cloud.microsoft

3 answers

Your answer