Forum Discussion
Entra Conditional Access Policy not blocking log ins from mobile devices
Hi there,
I have created a conditional access policy hoping to block users from accessing Power Apps apps from mobile devices.
I created the policy, and added myself as the user (to test).
Before this I often logged in to different Powerapps apps with my phone.
Now, on my phone, when I open power apps, I get a screen that says "You cannot access this right now - your sign-in was successful but does not meet the criteria to access this resource".
I click ok - then get the same screen again - I click ok again - then I am able to open any of the org's powerapps apps no problem.
When I check the logs in Entra, I can see 2 failed log in attempts, but zero successful log in attempts.
I confirmed it's a live connection - not cached. I can update records.
I'm hoping someone can help me figure this out?
Thanks,
Amber
9 Replies
Hi there.
I've pasted the details below.
I have one user in the 'include' and one user in the 'exclude' to test - we can both access it.
I did revoke sign-in sessions for myself, and was forced to log in everywhere again - but not the powerapps apps on my phone. I'm assuming there is some persistent token on my phone that allows me to stay logged in?
Thanks :)
AmberCan you share the set of resources included? And can you try without the client app condition?
Revoking sessions should have affected any valid refresh tokens, though it does not invalidate access tokens. If you have the option to test on a different device, this will tell us for sure whether something "cached" is causing this behavior.
FYI - I did try to access on another device, with my same credentials.
I get the "You cannot access this right now". The only option is to cancel. So I am blocked.
The difference on my cell (and the few others that it IS working on) is that there is an OK button, press it, the message shows up one more time, press it again - I'm allowed to use PowerApps.
How can I clear any caches, tokens, etc.?
A
Also, I moved the user that was in 'exclude' to 'include' - now he gets the same 2 failed messages, then is allowed to access the app...
Amber
Can you share the policy configuration? Have you tested with a different user or on a different device?
If you are seeing failed sign-in events in the logs, the policy likely functions OK, but the device might be reusing a previously obtained token. Logging off, or revoking sing-in sessions for the current user might work, though the latter will cause you to reauthenticate all apps you use this account with.
"You cannot access this right now" prompts followed by the app working is a classic sign that the policy is blocking one resource while the app gets tokens for another resource the policy doesn't cover. The Power Apps mobile player isn't a single resource. It talks to several back ends, and your policy is probably only catching one of them.
