Share via

Question regarding Microsoft Admin Portals app in Conditional Access

IMK 551 Reputation points
Nov 4, 2024, 4:35 PM

If I block access to resource "Microsoft Admin Portals" app from other users than admin users, do I also block normal user or guest user access to Windows Azure Active Directory, so that normal users or guest user can register their 2FA to satisfy requirement for all users to have 2FA to access any resource?

Microsoft Authenticator
Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation.
7,256 questions
Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
439 questions
Microsoft Intune Configuration
Microsoft Intune Configuration
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Configuration: The process of arranging or setting up computer systems, hardware, or software.
1,933 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,300 questions
{count} votes

2 answers

Sort by: Most helpful
  1. David Broggy 5,906 Reputation points MVP
    Nov 4, 2024, 5:10 PM

    Hi IMK,

    I don't see that it would be an issue, but it should be an easy thing to test.

    Another approach would be to use PIM and restrict all admin roles until they enable such rules in the PIM menu.

    Best regards.

    0 comments No comments

  2. Raja Pothuraju 8,495 Reputation points Microsoft Vendor
    Nov 6, 2024, 9:26 PM

    Hello @IMK,

    Thank you for posting your query on Microsoft Q&A.

    Blocking access to the "Microsoft Admin Portals" app for non-admin users will not prevent normal or guest users from accessing Microsoft Entra ID for purposes like 2FA registration. Regular users and guests can still access Entra ID to register for two-factor authentication (2FA), satisfying the requirement for all users to have 2FA to access any resource.

    The "Microsoft Admin Portals" app is specifically for administrative access to manage Microsoft Entra and other services. Restricting access to this app for non-admin users will only block their access to the admin portals; it won’t affect their access to other services or resources they’re authorized to use.

    You can safely block non-admin users from accessing the "Microsoft Admin Portals" app without impacting their access to Microsoft Entra for 2FA registration.

    The Microsoft Admin Portals suite includes:

    • Azure portal
    • Exchange admin center
    • Microsoft 365 admin center
    • Microsoft 365 Defender portal
    • Microsoft Entra admin center
    • Microsoft Intune admin center
    • Microsoft Purview compliance portal
    • Microsoft Teams admin center

    For more details, refer to the documentation on: Conditional Access and Microsoft Admin Portals.

    I hope this information is helpful. Please feel free to reach out if you have any further questions.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Thanks,
    Raja Pothuraju.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.