Conditional Access Policy Blocks Guests users from Accepting the invitations. Unable to exclude

Question

Hi Folks,&nbsp;&nbsp;I'm trying to implement a Conditional Access Policy to "Restrict All Apps" except "SharePoint" for Azure AD B2B (Guests) accounts. The idea is simple - I only want SharePoint to be accessed/shared with guests so trying to implement strict security from all possible levels in AAD (CA Policy is just one part of it).&nbsp;&nbsp;-The CA policy targets a specific group that includes all guests&nbsp;-All apps are blocked except "SharePoint"&nbsp;However, when guests try to accept the invitation, the request is being blocked with the following message.&nbsp;&nbsp;&nbsp;Error:&nbsp;You don't have access to this.&nbsp;Your sign-in was successful, but you don't have permission to access this resource.&nbsp;&nbsp;Azure AD Logs says the following app (Microsoft App Access Panel) is being blocked.&nbsp;&nbsp;&nbsp;So I tried to exclude it but CA Policy search can't find it (Although its there in the Enterprise Apps by default)&nbsp;Any ideas are greatly appreciated ! Thank you!&nbsp;

manojviduranga · Accepted Answer

Unfortunately this seems to be an all to common issue, from what I've read and experienced so far on this scenario. Microsoft hasn't exposed all of the apps (although you have that useful option to target ALL APPS) and they seem to indicate in documentation that targeting all applications should be used sparingly as it can and does have unintended consequences (from what I learned from my colleagues and limited web info).

If anyone have worked around this or have different thoughts please reply with your inputs. Greatly appreciated!

Forum Discussion

Conditional Access Policy Blocks Guests users from Accepting the invitations. Unable to exclude

2 Replies

Resources