Conditional access isn't applied to a group of users on a separate domain

Question

We have a small group of users on a separate domain which is part of the same tenant at our main domain. We've discovered that conditional access policies are not being applied to that group of users. CA policies are applied to all users. Also, sign in logs don't pick up the Device ID and Join Type for the users in question. All of them use BYOD devices.

Answer 1

Hi,

For BYOD:

• If the device is not registered in Entra ID (Azure AD), then:
  • No Device ID or Join Type shows in logs.
  • Device-based CA conditions (e.g., “Require compliant device”) won’t apply.
  • Entra ID treats it as an unregistered device, which may bypass or block some policies depending on configuration

Did you tried to check using "What if" function for that specific domain users which of your Entra ID CA applies to them?

1. Go to the Microsoft Entra admin center.
2. Navigate to: Protection → Conditional Access → What If