Forum Discussion

Ketzpatel's avatar
Ketzpatel
Brass Contributor
Oct 25, 2023

Exclude Microsoft first party applications in Azure conditional access policy

We have app built on Microsoft Graph resource and we have a conditional access policy that targets all cloud apps. when users sign into this app using Chrome browser on iOS they get error and prompt to use Edge. We do not want users to change the browser and tried to exclude Microsoft Graph from CA policy using all options including API but fails with the below error.

 

Policy contains invalid applications: unsupported firstpartyapplication.

 

Is there a way to exclude Microsoft Graph from the policy?

Authentication
Authenticator app
Azure AD
Azure Information Protection
Modern authentication
security
  • FlorianMueller's avatar
    FlorianMueller
    Copper Contributor
    Dec 19, 2023
    Same issue here for "Office 365" and "Sign Up" as applications to exclude needed. At the moment, it seems to only be allowed excluding "MgApplicationTemplate" and "MgApplication" applications.

    Definitely need more flexibility for CA policies.
    • FlorianMueller's avatar
      FlorianMueller
      Copper Contributor
      Apr 16, 2024
      The policy cannot be built, in my case, as "included" applications, because there are to many ways to attack M365 with application not possible to be included, e.g. Device Registration Service (cannot be included because no app with id).

Resources