This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 95%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
We want to allow only special applications with conditional access. Now we have the problem, the user want to change her password, but we don´t know which cloud app must be accessible.
I found this application name in the conditional access logs, but i can´t found the app "Microsoft App Access Panel" in the conditional access policy as cloud app.
Application: Microsoft App Access Panel
Application ID: 0000000c-0000-0000-c000-000000000000
Resource: Windows Azure Active Directory
Does anyone know which application i have to activate in the conditional access policy?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
In addition to my previous comment, I wanted to ask if you can give more details about your use case? What issue are you running into with the password change restriction? I will be able to push more for the prioritization of the feature request if there is a strong business case.
You can grant or block access to the specific applications for that user either in the CA policy or in the application access control.
Thank you very much for you reply.
We currently have to on-board various service providers again and again, who are only ever supposed to use very specific enterprise applications. In this case they are:
Office 365 Apps ans some apps as enterprise application with app proxy.
We have two conditional access policies for each service provider:
But now the situation is that users can never change their password. They are then automatically redirected to the helpdesk URL that can be specified in the teanant, in this case Jira ServiceDesk.
Mostly they are invited guests, but some have a real Azure AD account.
Thank you for the details. In that case this is expected behavior since the source of authority for those users will always be in their home tenant.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 5%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEL%3C/text%3E%3C/svg%3E)
This is a huge problem in out environment right now with not being able to exclude "Microsoft App Access Panel" from CA and this thread is over a year old.
Unfortunately Microsoft Support has been very unhelpful in this situation.
It is unacceptable for Microsoft to introduce Conditional Access but have these "one-off" applications that cannot currently be excluded.
This needs to be immediately resolved by Microsoft.
Hi @Manuel Maliszewski ,
Currently the Microsoft App Access panel is not onboarded yet into Conditional Access policies and the product group is still working to onboard this feature. While you can normally select "My Apps" when setting up Conditional Access rules, myapps has an underlying dependency application that is still under development and currently cannot be excluded.
This request has come up quite a few times and I have reached out to the product team and created a feature request to bubble this issue up with them, and have asked for an ETA. I also tested recently and saw that it is still not there, but I'll keep you posted if I hear anything new.
You are also welcome to create a feature request in the Ideas forum for this.
-
If the information provided was helpful to you, please remember to "mark as answer" so that others in the community with similar questions can more easily find the resolution.
Thank you very much for your reply. This is what i tried already with "My Apps":
But with this settings, it don´t work.