Exclude Office365 Exchange Microservices

Question

Exclude Office365 Exchange Microservices

Stephan van den Heuvel 61

Hi all,

We've set conditional access policies to control MFA to specific apps and resources. In 2 of those CA policies I configured a different sign-in frequency. One for external virtual desktop access (like 24 hours) and one for mobile Outlook App access (like 7 days).

By excluding Office365 Exchange Online in one CA policy and including it in the other this works fine for the Outlook app on iOS. You see it is accessing the resource named 'Office365 Exchange Online' in the sign-in logs and activating the 7 days sign-in frequency.

Android users however are complaining they get the 24 hours sign-in frequency. I've noticed a different resource named 'Office365 Exchange Microservices'. This is not a cloud app you can select in the pull down menu to exclude or include.

How can I mark or filter this resource in our CA policies?

Regards,

Stephan

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Anonymous

2023-11-23T06:33:06.8933333+00:00

Hello @Stephan van den Heuvel Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well.
Stephan van den Heuvel 61 Reputation points

2023-11-23T13:57:39.8733333+00:00

Hello,

The policies are set up to target all users and devices.

I've noticed Outlook app for Android sometimes connect through Exchange online and sometimes through Exchange Microservices.
Even my own Android tablet switches. So one time I have a 24 hour sign-in frequency and the other time the 7 days sign-in frequency.

I don't think we can setup the connection in the app ourselves, do we?
According to Google Playstore it is Microsoft Corporation who owns this app.

So please Microsoft, allow us to select Office 365 Exchange Microservices in CA policies or let all Outlook Mobile connections just flow through Office 365 Exchange Online.

I would like to hear the possibilities?

Thank you.

Regards,

Stephan
Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator

2023-12-04T06:34:10.86+00:00

@Stephan van den Heuvel Apologies for the delayed response on this post, wanted to check if the above mentioned issue/query still persists/not resolved ?

Please send us an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:Givary" along with your Azure subscription id and we will help you with free support options on this.
Paul Yates 5 Reputation points

2024-03-08T09:59:38.6533333+00:00

Same thing here, attempting to treat exchange access differently for Mobile devices but Outlook Mobile on Droid isn't fully targetable because I can't select "Office 365 Exchange Microservices" as a target resource in conditional access. Anyone find a way around this?
Alexis Reclus 0 Reputation points

2024-10-14T13:22:05.91+00:00

Hello,

We are facing the same issue, is there any way to exclude the 'Office365 Exchange Microservices' from CA for Android devices to grant access to Outlook mobile application?

Answer accepted by question author

Casper 85

Solved it by adding Office 365 Exchange Microservices as a service principal with PowerShell, then we were able to exclude it from Conditional Access.

New-AzureADServicePrincipal -AppId ec156f81-f23a-47bd-b16f-9fb2c66420f9

Tyler Wagler 10 Reputation points

2026-02-25T17:19:57.1566667+00:00
This is exactly what I needed and at perfect timing too. A 3 year old issue and a real solution posted the same month I needed it! Thank you! Also, it works to create the service principal with Microsoft Graph since New-AzureADServicePrincipal is part of the AzureAD powershell module which Microsoft has deprecated in favor of Microsoft Graph. Command is below. If you don't know how to switch over from AzureAD Powershell, install and open Powershell 7 (bypasses the memory limit that Powershell 5 has because MGGraph is huge). Install instructions below. Run one line at a time. The ID that comes out of the verify service principal name is the ID needed for Conditional Access when searching for a resource.

# Graph Module Install# Install-Module Microsoft.Graph -Scope CurrentUser #Connect to Graph with the right scope# Connect-MgGraph -Scopes "Application.ReadWrite.All" #Register the service principal# New-MgServicePrincipal -AppId "ec156f81-f23a-47bd-b16f-9fb2c66420f9" #Verify Service Principal has registered# Get-MgServicePrincipal -Filter "AppId eq 'ec156f81-f23a-47bd-b16f-9fb2c66420f9'" | Select-Object DisplayName, AppId, Id

New-MgServicePrincipal -AppId "ec156f81-f23a-47bd-b16f-9fb2c66420f9"

1 additional answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Anonymous

2023-11-23T06:33:06.8933333+00:00

Hello @Stephan van den Heuvel Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well.
Stephan van den Heuvel 61 Reputation points

2023-11-23T13:57:39.8733333+00:00

Hello,

The policies are set up to target all users and devices.

I've noticed Outlook app for Android sometimes connect through Exchange online and sometimes through Exchange Microservices.
Even my own Android tablet switches. So one time I have a 24 hour sign-in frequency and the other time the 7 days sign-in frequency.

I don't think we can setup the connection in the app ourselves, do we?
According to Google Playstore it is Microsoft Corporation who owns this app.

So please Microsoft, allow us to select Office 365 Exchange Microservices in CA policies or let all Outlook Mobile connections just flow through Office 365 Exchange Online.

I would like to hear the possibilities?

Thank you.

Regards,

Stephan
Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator

2023-12-04T06:34:10.86+00:00

@Stephan van den Heuvel Apologies for the delayed response on this post, wanted to check if the above mentioned issue/query still persists/not resolved ?

Please send us an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:Givary" along with your Azure subscription id and we will help you with free support options on this.
Paul Yates 5 Reputation points

2024-03-08T09:59:38.6533333+00:00

Same thing here, attempting to treat exchange access differently for Mobile devices but Outlook Mobile on Droid isn't fully targetable because I can't select "Office 365 Exchange Microservices" as a target resource in conditional access. Anyone find a way around this?
Alexis Reclus 0 Reputation points

2024-10-14T13:22:05.91+00:00

Hello,

We are facing the same issue, is there any way to exclude the 'Office365 Exchange Microservices' from CA for Android devices to grant access to Outlook mobile application?
Tyler Wagler 10 Reputation points

2026-02-25T17:19:57.1566667+00:00

This is exactly what I needed and at perfect timing too. A 3 year old issue and a real solution posted the same month I needed it! Thank you! Also, it works to create the service principal with Microsoft Graph since New-AzureADServicePrincipal is part of the AzureAD powershell module which Microsoft has deprecated in favor of Microsoft Graph. Command is below. If you don't know how to switch over from AzureAD Powershell, install and open Powershell 7 (bypasses the memory limit that Powershell 5 has because MGGraph is huge). Install instructions below. Run one line at a time. The ID that comes out of the verify service principal name is the ID needed for Conditional Access when searching for a resource.

# Graph Module Install# Install-Module Microsoft.Graph -Scope CurrentUser #Connect to Graph with the right scope# Connect-MgGraph -Scopes "Application.ReadWrite.All" #Register the service principal# New-MgServicePrincipal -AppId "ec156f81-f23a-47bd-b16f-9fb2c66420f9" #Verify Service Principal has registered# Get-MgServicePrincipal -Filter "AppId eq 'ec156f81-f23a-47bd-b16f-9fb2c66420f9'" | Select-Object DisplayName, AppId, Id

New-MgServicePrincipal -AppId "ec156f81-f23a-47bd-b16f-9fb2c66420f9"

Answer 1

Andy David - MVP 160.3K MVP Volunteer Moderator

From what I have seen, if you cant target it with a policy then its built in the larger application and you wont be able to get around that other than targeting specfic users perhaps versus devices.

0 comments