This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 53%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
Hi. I have an CAP blocking all cloud apps, and excluding a few apps.
This is blocking Microsoft Authenticator App causing users not to approve their MFA request.
I have not found a way to exclude Microsoft Authenticator App from the Conditional Access Policy.
Workaround is to change CAP to not include all cloud apps, but manually select apps to be included in the policy.
Anyone have any ideas if its possible to exclude Authenticator App from an CAP configured to include all cloud apps?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 88%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBD%3C/text%3E%3C/svg%3E)
You can exclude using the device filter option device.mdmAppId -eq "29d9ed98-a469-4536-ade2-f981bc1d605e"...
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 24%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
Conditional Access Policies will not let you exclude 1st party applications. There is a user voice request out there to allow CAPs to distinguish the 1st party applications and allow your scenario. Could you remove the licenses to all the 1st party apps that you do not want users to get to (e.g. SharePoint, Outlook, etc), and exclude the 1st party apps from your Block All policy? Another option you could look at is see if Cloud App Security could do something similar, but I haven't tried that.
Thanks Matt. Cloud App Security will be able to handle the app, however not sure if it will allow me to exclude it in an CAP though. Likely not.
I can manually register the Microsoft Authenticator App in Azure AD and it will become available in CAP to be included or excluded, however I guess this will not work since the app ID for my AAD registered app will not match the ID of the app end users are using, and as far as i know you can't change the App ID for an registered AAD app?
How did you manually register the Authenticator App in AAD? The MS owned apps all have App IDs that should be constant across all tenants:
https://github.com/Seb8iaan/Microsoft-Owned-Enterprise-Applications/blob/main/Microsoft%20Owned%20Enterprise%20Applications%20Overview.md
Sorry for being unclear. I can manually register an app with that name, however the appID will differ from the real app used by users thus not going to work in any CAP. I believe its a shame that Microsoft can't make their Authenticator App and other applications/services available to be added into Azure AD to allow using them in CAP rules. Guess there is a reason for this, although I can't currently see it.
I am having this issue too. I need to allow a selection of users to only access Azure Virtual Desktop app (but require MFA). I can create a CA policy to include All Apps, and Exclude Azure Virtual Desktop, with an action of Block - but the users cant then approve the MFA prompts in their Authenticator App as it blocks them access to that app. The 'Microsoft Authenticator App' cant be exempted from a CA policy (but Azure Virtual Desktop, for example, can).