Conditional Access will only trigger for explicitly requested scopes

Effective date: August 2021, with gradual rollout starting in April. Endpoints impacted: v2.0 Protocol impacted: All flows using dynamic consent Applications using dynamic consent today are given all the permissions they have consent for, even if they weren't requested by name in the scope parameter. An app requesting only user.read but with consent to files.read can be forced to pass the Conditional Access requirement assigned for files.read, for example. To reduce the number of unnecessary Conditional Access prompts, Microsoft Entra ID is changing the way scopes are provided to applications so only explicitly requested scopes trigger Conditional Access. Applications relying on Microsoft Entra ID's previous behavior of including all scopes in the token--whether requested or not--may break due to missing scopes. Apps will now receive access tokens with a mix of permissions: requested tokens and those they have consent for that don't require Conditional Access prompts. The scope of access for the token is reflected in the token response's scope parameter. This change will be made for all apps except those with an observed dependency on this behavior. Developers will receive outreach if they're exempted from this change, as them may have a dependency on the additional Conditional Access prompts. Examples An app has consent for user.read, files.readwrite, and tasks.read. files.readwrite has Conditional Access policies applied to it, while the other two don't. If an app makes a token request for scope=user.read, and the currently signed in user hasn't passed any Conditional Ac…

Permanent link to this revision