How to exclude Microsoft Office 365 Portal from the microsoft admin portals - conditional access

Question

How to exclude Microsoft Office 365 Portal from the microsoft admin portals - conditional access

Aran Billen 956

Hi all,

I have a conditional access policy to block Microsoft admin portals to all users except specific users (it team) however users who want to download office apps to their devices are unable to as Microsoft Office 365 Portal is included is the Microsoft admin portals, is there a way I can exclude this one portal from the conditional access policy?

I cant find Microsoft Office 365 Portal as an app to exclude it.

Answer accepted by question author

3 additional answers

Your answer

Answer 1

Andy David - MVP 159.7K MVP Volunteer Moderator

365 is only available as a service, so you cant isolate just the portal. There is no option currently to scope to just one of those portals and not the others. (You can scope to the Azure mgmt apps but not to the portal only there neither)

You can filter by the 365 apps , but not the portal specifically.

Aran Billen 956 Reputation points

2024-04-30T11:20:31.0866667+00:00

Thanks
Jeremy 110 Reputation points

2024-12-08T21:17:37.0933333+00:00

This isn't correct. The Microsoft Office 365 Portal is listed here as one of the apps belonging to the conditional access "Office 365" app, which means it's possible to exclude it in a conditional access policy.

Furthermore, the "Office 365" app (and therefore the Microsoft Office 365 Portal) is not an admin portal app. The fact that Microsoft seems to include it in CA policies that target the "Microsoft Admin Portals" app seems like a bug to me.

As Aran Billen pointed out in his question here, a CA policy that is intended to prevent regular users from accessing the Microsoft Admin Portals should not also prevent those users from accessing the Microsoft Office 365 Portal, which is needed to download copies of the Office apps and is most definitely not an admin portal.

Answer 2

Andy David - MVP 159.7K MVP Volunteer Moderator

not possible since its bundled as an app.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#microsoft-admin-portals

Aran Billen 956 Reputation points

2024-04-30T11:03:11.0366667+00:00

no other way? Filtering it out or something?
Jeremy 110 Reputation points

2024-12-08T21:12:33.12+00:00

I don't believe this is correct. The Microsoft Office 365 Portal is not included in the list of admin portals at that URL. On the other hand, the Microsoft Office 365 Portal is included as one of the apps belonging to the "Office 365" conditional policy app, which is not an admin portal app:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/reference-office-365-application-contents

Furthermore, it is possible to add "Office 365" (and therefore the the Microsoft Office 365 Portal) as an excluded app in a conditional access policy.

Answer 3

Versloot, Arjan 0

did you manage to solve this problem?

Thanks

Answer 4

Vuy Si 31

Yes it's possible by configuring your conditional access policies target resources to include Microsoft Admin Portals and explicitly exclude Microsoft Office 365 Portal 00000006-0000-0ff1-ce00-000000000000

Share via

How to exclude Microsoft Office 365 Portal from the microsoft admin portals - conditional access

3 additional answers

Your answer