AADSTS53003 Conditional Access blocking client credentials token issuance despite no policies applied

Question

Post:

I’m using client credentials flow with an Azure AD app registration to call Microsoft Graph API from an internal API. Token acquisition fails with this error:

pgsql
Copy
AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.

What I’ve done:

Disabled Security Defaults.

Removed all Conditional Access policies.

Verified with the CA “What If” tool that no policies apply.

Using app-only permissions (https://graph.microsoft.com/.default).

Issue:

Even with no CA policies or Security Defaults enabled, token requests are still blocked with this error.

Goal: To successfully acquire tokens via client credentials flow in order to call Microsoft Graph API securely from an internal API service.

Questions:

Why does this error persist when no CA policies are active?

Could there be tenant-level settings or other configurations causing this?

• How can I troubleshoot or fix token issuance blocking in this scenario?Post: I’m using client credentials flow with an Azure AD app registration to call Microsoft Graph API from an internal API. Token acquisition fails with this error:

    pgsql
    Copy
    AADSTS53003: 
  

  What I’ve done:
  • Disabled Security Defaults.
  • Removed all Conditional Access policies.
  • Verified with the CA “What If” tool that no policies apply.
  • Using app-only permissions (https://graph.microsoft.com/.default).
  Issue: Even with no CA policies or Security Defaults enabled, token requests are still blocked with this error. Goal:
  To successfully acquire tokens via client credentials flow in order to call Microsoft Graph API securely from an internal API service. Questions:
  • Why does this error persist when no CA policies are active?
  • Could there be tenant-level settings or other configurations causing this?
  • How can I troubleshoot or fix token issuance blocking in this scenario?

Answer 1

Mikail Ceran hi there, and thanks for posting this...

even when u remove ALL conditional access policies, azure ad has some sneaky default protections for client credentials flow. they don't show up in the CA portal but they exist :)

check if u have any "tenant restrictions" enabled. these can block tokens without appearing in normal CA policies. another sneaky culprit could be "app management policies". they live at azure portal > azure ad > enterprise applications > app management policies. sometimes they override everything else :(

try this quick fix go to azure ad > security > identity protection, look for "mfa registration policy" or "user risk policy" - disable them temporarily just to test, also check "app consent policies" under azure ad > enterprise applications. if it still fails... here's the nuclear option (but it works): create a NEW conditional access policy that EXPLICITLY allows client credentials flow for your app. yes, u need to add a policy to fix "no policy" blocking )) irony at its finest.

when creating this policy, be sure target your specific app/service principal, select "client credentials" as the grant control, exclude all users (yes, exclude them, its weird but necessary)

let me know if my explanations helps

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment

https://ctrlaltdel.blog/