Entra ID Conditional Access

Handian Sudianto 6,706

I have some web application and this application will generete some notificatiin thru email.

Now i want to limit the sender only can be accessed from internal network and from azure app service.

I can make Entra conditional access by puting our public ip to teh condition, but how if the sender authenticate from azure web apps?

Sridevi Machavarapu 16,520 Reputation points Microsoft External Staff Moderator

2025-12-23T05:34:13.18+00:00
Hello Handian Sudianto,

Conditional Access can help only partially in this scenario.

In Microsoft Entra ID, Conditional Access is evaluated only for user sign-ins. So yes, you can restrict users by adding your internal public IPs as a named location.

However, when the sender runs from Azure App Service, it normally authenticates using an application identity (service principal or managed identity). That authentication does not involve a user sign-in, so Conditional Access is not applied.

Because of this:

You cannot use Conditional Access to allow or block access “from Azure App Service”

Azure App Service outbound IPs are shared and change over time, so they are not supported as trusted locations

Recommended approach

Use managed identity or app-only authentication for the web app

Grant only the permissions required to send email

Enforce restrictions at the application or mail layer (for example, validate the calling app’s service principal or use Exchange Online mail flow rules)

In short, use Conditional Access for users from your internal network, and use app-only controls for Azure App Service.

Your answer