Conditional Access policies now apply to all client applications by default

Until unauthorized access installs AAD Request Verification Service -PROD | Permissions, enterprise app. Your application can acquire a token to call a Web API hosted in your App Service or Function app on behalf of itself (not on behalf of a user). This scenario is useful for non-interactive daemon applications that perform tasks without a logged in user. It uses the standard OAuth 2.0 https://docs.microsoft.com/en-us/azure/active-directory/azuread-dev/v1-oauth2-client-creds-grant-flow grant.   Be careful this is how the system is being compromised.   So be careful