Conditional Access Policy applying to cloud app that is excluded in the policy

Question

We enforce MFA for users via a conditional access policy. We have an application that does not support MFA and, based on the nature of the application, we are OK not enforcing conditional access on this application. Accordingly, we've excluded the app in the conditional access policy's "Cloud apps or actions" section. Lets all this policy "Policy 1". This appeared to work when we set it up. However, looking through Azure AD sign in logs today, I can see that users are failing to log in to the application and, when I look at why, I can see they are failing on "Policy 1" because this policy is enforcing MFA. The sign in event is clearly associated with this app and I can verify that this app is excluded in "Policy 1", yet the policy is still firing. The app has been excluded now for over a month (this is not a recent change). Why is the conditional access policy still applying even though the app is excluded within the policy?

Answer 1

Hi @Alex Rourke • Thank you for providing the required information.

Looking at the details at our backend, I found that your Ba*****a Ne****s app calls the Windows Azure Active Directory Graph resource (App ID 00000002-0000-0000-c000-000000000000), and a policy that requires MFA is getting applied to this resource.

As the "All User MFA" policy includes all applications, the app 00000002-0000-0000-c000-000000000000 is also getting protected by this policy and is requiring MFA when this app is called.

Now, the challenge is, that this app doesn't get listed in the conditional access policy. So there is no easy solution to this problem i.e., excluding this app from the "All User MFA" Policy. To get it working without changing any other conditions of your CA policy, you need to explicitly specify the applications that you want to include in the CA Policy rather than including all cloud apps.

Ref: Application IDs for commonly used Microsoft applications

Hope this helps.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Excluding "Directory Synchronization Accounts" in the Conditional Access policies that enforce MFA did the trick for me.

The account used for synchronization itself was already excluded from MFA. However, this turned out to be insufficient.

I did not need to explicitly define which Entra ID apps should be subject to MFA.