Published Jan 29, 2026
Starting March 27, 2026, Conditional Access policies targeting All resources will be enforced even if they have resource exclusions, affecting sign-ins requesting only certain OIDC or directory scopes. Most organizations need no action unless custom apps request only these scopes and cannot handle Conditional Access challenges.
Updated January 30, 2026: We have updated the content. Thank you for your patience.
You are receiving this message because our telemetry indicates that you have at least one Conditional Access policy targeting All resources with one or more resource exclusions.
As described in this Microsoft Entra Blog post, we’re enhancing how Conditional Access policies that target All resources and have resource exclusions are enforced for a narrow set of authentication flows. This is a proactive security measure in alignment with Microsoft’s ongoing commitment to defense-in-depth.
What is changing?
Today, when a user signs in through a client application that requests only OIDC scopes or a limited set of directory scopes, Conditional Access policies that target All resources are not enforced if the policy has one or more resource exclusions.
After this change, Conditional Access policies that target All resources will be enforced for these sign-ins, even when resource exclusions are present. Read more about this change.
When will you see this change?
Microsoft Entra ID will begin enforcing this change starting March 27, 2026. This will be rolled out progressively over several weeks until June 2026.
How will this affect your organization?
When a user signs in through a client application that requests only the scopes listed above, users may now receive Conditional Access challenges (such as MFA or device compliance) where previously they were allowed access without enforcement. The exact challenge depends on the access controls configured in your policies that target All resources or policies that explicitly target Azure AD Graph as a resource.
What do you need to do to prepare?
In most cases, no action is required, as most client applications request additional scopes beyond those listed above and are already subject to Conditional Access enforcement. In such cases, there is no change in behavior.
If you have custom applications that are intentionally designed to request only the scopes listed above, evaluate whether they can handle Conditional Access challenges such as MFA or device compliance.
Learn more:
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.