got "[AADSTS53003]: Access has been blocked by Conditional Access policies" for access DB from AME tenant to Microsoft tenant

Question

The content is same as https://stackoverflow.microsoft.com/questions/472151

I got "[AADSTS53003]: Access has been blocked by Conditional Access policies" when I tried to access a database in the Microsoft tenant from an azure function in AME tenant.

I did some tests and confirmed that

in the azure VM, I can get the data from DB currently

but in the func app, it can get fed token, but got AADSTS53003

compare the fed token between VM's and func app's, token data seems correctly in both sides.

However, I do not have right to change the "Conditional Access policies" for the enterprise application.

Could someone please give me some hint to fix it?

=====

the log is as below

Result: Failure Exception: ConnectionError: Failed to retrieve MoAD access token after 3 attempts. client_id=74cd4af2-cafa-41cd-a37f-b3e6156954b8, app_client_id=74cd4af2-cafa-41cd-a37f-b3e6156954b8, target_tenant=72f988bf-86f1-41af-91ab-2d7cd011db47, has_fed=True

Stack: File "/azure-functions-host/workers/python/3.12/LINUX/X64/azure_functions_worker/dispatcher.py", line 546, in handle__function_load_request func = loader.load_function( ^^^^^^^^^^^^^^^^^^^^^ File "/azure-functions-host/workers/python/3.12/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 44, in call return func(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^ File "/azure-functions-host/workers/python/3.12/LINUX/X64/azure_functions_worker/loader.py", line 220, in load_function mod = importlib.import_module(fullmodname) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/python/3/lib/python3.12/importlib/init_.py", line 90, in import_module return _bootstrap._gcd_import(name[level:], package, level) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "

Answer 1

Hi Jackie,

your function app in the AME tenant is getting a valid token, but when it presents it to the Microsoft tenant, a conditional access policy is blocking the request, resulting in the AADSTS53003 error.

The key issue is that the Conditional Access policy in the target Microsoft tenant is evaluating the login attempt from your function app and deciding to block it. Common reasons for this include

The policy requires a compliant device, and the Azure Function's managed identity isn't recognized as one.

The policy restricts access to specific locations (IP ranges), and the outbound IPs of your Function App aren't approved.

It requires Multi-Factor Authentication (MFA), which a managed identity cannot perform.

Since you mentioned you don't have rights to change the Conditional Access policies, you need to work with the administrator of the Microsoft tenant (the one with 72f988bf-86f1-41af-91ab-2d7cd011db47).

Provide them with the following details so they can create an exemption or modify the policy to allow your function app

The Service Principal of your function app's managed identity. They can find this by the client_id in your logs: 74cd4af2-cafa-41cd-a37f-b3e6156954b8.

The outbound IP addresses of your Azure Function App. You can find these in the Azure portal under your Function App's properties.

Ask the admin to create an exclusion in the Conditional Access policy for this specific service principal or its IP addresses.

You are correctly authenticated, but authorized. You must collaborate with the Microsoft tenant's admin to adjust their Conditional Access policy to grant your function app access. 

regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/