Conditional Access and Microsoft Authenticator Sign In

Question

We're using conditional access policy to restrict access to 'Register security information' to trusted locations only. This policy blocks home users from signing into the Microsoft Authenticator. How are you handling this security recommendation?

Answer 1

Hi @Anon4343

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

Conditional access policy to restrict access to 'Register security information' to trusted locations only. This policy blocks home users from signing into the Microsoft Authenticator.

Solution:

TAP does not override conditional access policies. It's only a substitute for MFA challenges. On the conditional access policy, we had to create an exclusion security group and temporarily add the user to that group. After the user signed into the Authenticator, we removed the user from the security group.

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

I hope this helps! Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Thanks,

Navya.

Answer 2

You would need to use TAP with this for users when they register:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-registration