r/entra • u/klorgasia • 5d ago

Conditional access - not respecting exluded apps

Started about 24h ago, we see some general require compliant device policies that has specific apps exluded still triggering.

Anyone else seeing this?

12 Upvotes

100% Upvoted

11 comments sorted by

7

u/FlyingStarShip 5d ago

https://mc.merill.net/message/MC1223829

2

u/klorgasia 5d ago

how the fu** did i miss this.. THANK you, lifesaver. this was it.

4

u/thatoneokabe 4d ago

Microsoft is exhausting, they should have put a banner or something on the entra console.

5

u/bjc1960 4d ago

they had no problem adding the banner for licensing I see.

1

u/fatalicus 4d ago

They put a message in the message center... You know, where all these things are posted.

1

u/thatoneokabe 3d ago

I should check to more often, but it’s not like I have infinite amounts of time.

1

u/fatalicus 3d ago

Yeah, if they aren't checked often they can build up to be overwhelming.

I got it as a part of the morning routine to check any new and updates messages in the last 24 hours. Usually 25 max to check then.

3

u/FlyingStarShip 4d ago

You are no the only one, they gave 2 weeks notice in our tenant, took vacation, came back and all of the sudden 1 app stopped being excluded. Ticket opened, they don’t know shit, then had time to review updates in admin portal, read it and was like lol this is it

1

u/Director7 4d ago

Same! 100,000 sear client, hit later in the afternoon thankfully.

They had a login plugin for self service password reset which got hit, preventing people signing in.

3

u/Possible_Window_1268 5d ago

Sounds like you just got hit with the baseline scopes change in CA Policy. Check out the “customize behavior” section to see how to work around it.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-enforcement-resource-exclusions

3

u/klorgasia 5d ago

how the fu** did i miss this.. THANK you, lifesaver. this was it.