AzureAD Conditional access rules ignore exclude extension attribute filter

Jeremy Pot 21

When filtering for devices the ExtensionAttribute rule is ignored, both policies seem to always apply regardless of the extensionAttribute that's set.

You can reproduce this behavior in the whatif tool.

Policy #1
"deviceFilter": {
"mode": "exclude",
"rule": "device.extensionAttribute3 -ne "MFA Allowed""
},

Policy #2
"deviceFilter": {
"mode": "exclude",
"rule": "device.extensionAttribute3 -eq "MFA Allowed""
},

Reproduce:
Create the two policies
Go to whatif tool
Set device extension attribute3 to MFA Allowed
Only Policy 1 should apply.

Clear device extension attribute 3
Only policy 2 should apply.

Actual behavior:
Both policies always apply.

Sandeep G-MSFT 16,696 Reputation points Microsoft Employee

2022-10-11T14:51:26.26+00:00

@Jeremy Pot

I have tried this in my lab and it is working as expected. I created 2 different policies as you had mentioned above.
When I use whatif tool and set extension attribute 3 as "MFA Allowed", policy one is getting applied. and when I use whatif tool without keeping the extension attribute 3 value, second policy is getting applied. Looks like there is something common that you might have configured in both policies at your side.

Share via

AzureAD Conditional access rules ignore exclude extension attribute filter