Conditional Access target resources
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 833eded · +11 −5 lines · also on GitHub
⋯ 1 unchanged line
22
title: Targeting Resources in Conditional Access Policies
33
description: Learn how to configure Conditional Access policies to target specific resources, actions, and authentication contexts in Microsoft Entra ID.
44
ms.topic: concept-article
5
−ms.date: 01/26/2026
6
−ms.reviewer: lhuangnorth
5
+ms.date: 02/24/2026
6
+ms.reviewer: kvenkit
77
ms.custom:
88
- has-azure-ad-ps-ref
99
- ai-gen-docs-bap
⋯ 65 unchanged lines
7575
7676
## Microsoft Admin Portals
7777
78
−When a Conditional Access policy targets the Microsoft Admin Portals cloud app, the policy is enforced for tokens issued to application IDs of the following Microsoft administrative portals:
78
+When a Conditional Access policy targets the Microsoft Admin Portals cloud app, the policy is enforced for tokens issued to specific application IDs. Those application IDs don't always correlate to one portal. When creating the Conditional Access policy, select the admin portal from the list. When reviewing logs that target these portals, however, the details reflect the underlying resource application IDs. For more information, see the [Audience reporting](troubleshoot-conditional-access.md#audience-reporting) section in the **Troubleshooting sign-in problems** article.
7979
8080
- Azure portal
8181
- Exchange admin center
8282
- Microsoft 365 admin center
8383
- Microsoft 365 Defender portal
84
−- Microsoft Entra admin center
84
+- Microsoft Entra admin center
85
+ - Azure portal app ID: c44b4083-3bb0-49c1-b47d-974e53cbdf3c
8586
- Microsoft Intune admin center
87
+ - Azure portal app ID: c44b4083-3bb0-49c1-b47d-974e53cbdf3c
8688
- Microsoft Purview portal
89
+ - Microsoft 365 365 Security and Compliance Center app ID: 80ccca67-54bd-44ab-8625-4b79c4dc7775
8790
- Microsoft Teams admin center
91
+ - Microsoft Office 365 app ID: 00000006-0000-0ff1-ce00-000000000000
8892
89
−We're continually adding more administrative portals to the list.
93
+The Admin Portal grouping is primarily intended for include scenarios,for a simplified way to target one or more admin portals with Conditional Access policies (for example, enforcing MFA). This grouping is leveraged in our [MFA for admins Microsoft-managed policy](managed-policies.md#multifactor-authentication-for-admins-accessing-microsoft-admin-portals) to streamline policy creation.
94
+
95
+This option is not designed to serve as a bulk exclusion mechanism for backend services.
9096
9197
> [!NOTE]
9298
> Block policies that target the Microsoft Admin Portals will block end users from accessing the Microsoft 365 self-install page, as this page is currently located in the Microsoft 365 admin center. For information on alternative deployment options, see [Plan your enterprise deployment of Microsoft 365 Apps](/microsoft-365-apps/deploy/plan-microsoft-365-apps).
⋯ 398 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.