Conditional Access Policy is not granting the access when the application is in Exclude list

Question

Hi,
In our Conditional Access Policy where action is to Block, we are trying to include "All Cloud Apps" in Include list and "Microsoft Azure Management" application in Exclude list. When a user tries to access "Microsoft Azure Management" and as per the logs, the Conditional Access Policy initially evaluates Exclude list and grants access with Success response. And then evaluates Include list and blocks the "Microsoft Azure Management" and this is not expected because this application specifically given in Exclude list.

Also when we tried to test using What If, it results as expected but when tested the actual scenario it is not giving expected result.

Could you please share any inputs ?

Answer 1

Hello @Shanmugham, Sudha ,

Welcome to the MS Q&A Forum.

The Azure Active Directory (Azure AD) sign-ins log is a valuable source of information when troubleshooting why and how Conditional Access policy applied in your environment. The information in this article can be used to troubleshoot unexpected sign-in outcomes related to Conditional Access using Azure AD sign-ins log.

In some specific scenarios, users can be blocked because there are cloud apps with dependencies to other resources and these resources are being blocked by CA Policy. Example below shows user was trying to sign into Azure DevOps ("Application") and access was blocked by CA policy.

This happened as an admin configured CA Policy that blocks access on all applications except for Azure DevOps app.

Meanwhile, DevOps has dependencies with Windows Azure Service Management API ("Resource") and CA Policy was enforced while accessing it. An admin must also exclude dependencies app from the CA Policy to allow access to the Azure DevOps.

The What If tool doesn't test for Conditional Access service dependencies. For example, if you're using What If to test a Conditional Access policy for Microsoft Teams, the result doesn't take into consideration any policy that would apply to Office 365 Exchange Online, a Conditional Access service dependency for Microsoft Teams.

Hope above answers your questions and concerns.

--------------------------------------------------------

Let us know if you need additional assistance. If the answer was helpful, please accept it and complete the quality survey so that others can find a solution.

Sincerely,
Olga Os

Answer 2

Thank you Olga Os. This information helps.

Also found this info in Service Dependencies which can be referred.

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access#conditional-access-error-codes

Is it possible to give more insights about application, resource and dependencies and how they are related? It will help to debug issue faster.

Answer 3

Engineering Groups are continuously working to improve the Microsoft Azure Platform and troubleshooting processes to help ensure you have all required tools to resolve it. Your feedback is very important to us. We use it to continually improve our service.

As example, "Troubleshoot event" feature may show related information on your side.

Sincerely,
Olga Os