Why can't "Microsoft-Managed" CA policies be deleted even after turning them off?

Question

Why can't "Microsoft-Managed" CA policies be deleted even after turning them off?

Knut Sander Lien Blakkestad 20

Wy can't "Microsoft-Managed" CA policies be deleted after turning them off?

Anonymous

2025-04-28T13:17:51.99+00:00

Hello Knut Sander Lien Blakkestad
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others.
Knut Sander Lien Blakkestad 20 Reputation points

2025-04-29T05:56:41.68+00:00

Hi @Anonymous

Sorry for taking a while to respond. Your first comment clarifies things, but I still believe that deleting or at least removing these policies should be an option.

Hopefully it will become possible in the future, but until then I guess I'll have to deal with disabled policies filling up the CA overview.
Anonymous

2025-04-29T09:21:49.42+00:00

Hello Knut Sander Lien Blakkestad

You're absolutely right to feel that way, many admins share the same feedback. From a usability and policy hygiene standpoint, having non-removable, disabled entries clutter the Conditional Access overview can be confusing.

Microsoft’s current approach leans heavily toward ensuring baseline security That said, feedback like yours does make a difference: Microsoft does listen via channels like the Azure Feedback Portal and UserVoice (where applicable), and they've occasionally adjusted features based on widespread demand. If Microsoft introduces more flexibility in this area in the future, I’ll be happy to help you update your environment accordingly.

If you feel this clarified your question Please remember to "Accept Answer", so that others in the community facing similar issues can easily find this post.
laughey 51 Reputation points

2026-03-26T17:55:07.9733333+00:00

Shocker!

Like federally elected officials in our great US of A, this is just another Microsoft knows best being laid upon everyone in their world...with ZERO consideration for, get this, the fact that we already have a Block legacy authentication CAP in play.

Yeah, given the limited ability to organize, sort, filter, etc., said CAPs, we established a naming convention that works for us. But that's not good enough for them folks at Microsoft. Now we have two additional CAPs that'll sit there doing jack squat because Microsoft says so. Meanwhile, action items admins have been begging for from Microsoft continue to be ignored.

Give it up for Microsoft technology and AI making our lives easier! /S

Just nine more years of this BS before I can sit back and laugh at all the ridiculousness.

Answer accepted by question author

0 additional answers

Your answer

Anonymous

2025-04-28T13:17:51.99+00:00

Hello Knut Sander Lien Blakkestad
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others.
Knut Sander Lien Blakkestad 20 Reputation points

2025-04-29T05:56:41.68+00:00

Hi @Anonymous

Sorry for taking a while to respond. Your first comment clarifies things, but I still believe that deleting or at least removing these policies should be an option.

Hopefully it will become possible in the future, but until then I guess I'll have to deal with disabled policies filling up the CA overview.
Anonymous

2025-04-29T09:21:49.42+00:00

Hello Knut Sander Lien Blakkestad

You're absolutely right to feel that way, many admins share the same feedback. From a usability and policy hygiene standpoint, having non-removable, disabled entries clutter the Conditional Access overview can be confusing.

Microsoft’s current approach leans heavily toward ensuring baseline security That said, feedback like yours does make a difference: Microsoft does listen via channels like the Azure Feedback Portal and UserVoice (where applicable), and they've occasionally adjusted features based on widespread demand. If Microsoft introduces more flexibility in this area in the future, I’ll be happy to help you update your environment accordingly.

If you feel this clarified your question Please remember to "Accept Answer", so that others in the community facing similar issues can easily find this post.
laughey 51 Reputation points

2026-03-26T17:55:07.9733333+00:00

Shocker!

Like federally elected officials in our great US of A, this is just another Microsoft knows best being laid upon everyone in their world...with ZERO consideration for, get this, the fact that we already have a Block legacy authentication CAP in play.

Yeah, given the limited ability to organize, sort, filter, etc., said CAPs, we established a naming convention that works for us. But that's not good enough for them folks at Microsoft. Now we have two additional CAPs that'll sit there doing jack squat because Microsoft says so. Meanwhile, action items admins have been begging for from Microsoft continue to be ignored.

Give it up for Microsoft technology and AI making our lives easier! /S

Just nine more years of this BS before I can sit back and laugh at all the ridiculousness.

Answer 1

Hello Knut Sander Lien Blakkestad

Even after you turn off Microsoft-managed Conditional Access (CA) policies, you can’t delete them because:

These policies are created and controlled by Microsoft to enforce essential security best practices like requiring MFA for admins or blocking legacy auth. Microsoft treats these as foundational, so instead of letting tenants delete them, it allows you to disable them if needed (though it’s not recommended unless you’ve replaced them with your own equivalent policies).

Entra ID, these policies are flagged as “Microsoft-Managed.” That flag prevents them from being deleted even by Global Admins. It’s sort of like a system file in Windows you can hide it or stop it from running but not delete it outright.

Regarding this it is mentioned in Microsoft public document: https://learn.microsoft.com/en-us/entra/identity/conditional-access/managed-policies

User's image

Microsoft’s current approach leans heavily toward ensuring baseline security That said, feedback like yours does make a difference: Microsoft does listen via channels like the Azure Feedback Portal and UserVoice (where applicable), and they've occasionally adjusted features based on widespread demand. If Microsoft introduces more flexibility in this area in the future, I’ll be happy to help you update your environment accordingly.

If you feel this clarified your question Please remember to "Accept Answer", so that others in the community facing similar issues can easily find this Post.