Why MFA, Conditional Access, and Sensitivity Labels can Combine to Give Outlook a Problem

[Tony Redmond]

If conditional access policies impose MFA for all cloud apps, it gives external users a problem when they use Outlook desktop to read protected email. The issue is because Outlook can’t obtain a use license to decrypt the content because it can’t satisfy the MFA challenge. It’s an example of how two good parts of the Microsoft 365 ecosystem clash.

https://office365itpros.com/2024/02/12/conditional-access-mfa-email/

[#2]

@Tony Redmond 

I thought we can apply some exclusion or exception

[#3 · Accepted solution]

And that's what's explained in the article, together with a PowerShell script to apply the exclusion to the CA policies in a tenant.