Enterprise App SSO with conditional access, needed Microsoft Graph resources for sign-in

Question

Hi,

We have created an Enterprise App for VPN SSO with a 3rd party platform which works properly. We have also created a Conditional Access Policy that restricts access from anywhere outside the US. When a person tries to log in outside the country, we receive the error "XXX needed Microsoft Graph resources for sign-in" I have excluded the SSO App from the CA policy as well as added Security Attributes to any apps that belong to Graph, i.e. Microsoft Graph, Azure Graph, graphstore, graphexplorer, etc. and excluded anything with those attributes from the policy. I am still receiving the graph is needed error though when someone tries to log in.
I performed a Conditional Access "What IF" test from Entra but when I select the SSO App, it shows the CA policy not applied.
I feel I am at a catch 22 as the CA bypasses the VPN IP but you can't connect to the VPN app to authenticate.
Any guidance would be great.

Answer 1

@Andy David - MVP

Than you for the response.
When trying to sign into the custom Enterprise app from outside the US, they receive a failure and it logs this:

When I launch the sign-in diagnostics, it shows this:

The SSO app is excluded from the CA policy and for testing, I have excluded the following Apps from the policy:

However, the user still receives the error.
Thank you again.

Answer 2

The office 365 app actually has ties to Graph. What happens if you exclude that as well and test?