ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 8/9 advisories · checked 11:37 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1223829 Stay informedUpdated messageFeature updateUser impactAdmin impact

Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions

Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Entra
Microsoft 365 admin center

Rollout

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions this installation saw
  • Seen 13 May 2026 May 13, 2026 → June 15, 2026
  • Seen 20 Mar 2026 March 27, 2026, June 2026 → May 13, 2026

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, with source markup removed
Updated July 31, 2026: We have updated the content. Thank you for your patience.  You are receiving this message because our telemetry indicates that you have at least one Conditional Access policy targeting All resources with one or more resource exclusions. As described in this Microsoft Entra Blog post, we’re enhancing how Conditional Access policies that target All resources and have resource exclusions are enforced for a narrow set of authentication flows. This is a proactive security measure in alignment with Microsoft’s ongoing commitment to defense-in-depth. What is changing? Today, when a user signs in through a client application that requests only OIDC scopes or a limited set of directory scopes, Conditional Access policies that target All resources are not enforced if the policy has one or more resource exclusions. After this change, Conditional Access policies that target All resources will be enforced for these sign-ins, even when resource exclusions are present. Read more about this change. In addition, customers who have scenarios that may be impacted by this change will have the ability to retain the current behavior while they assess impact and transition to the recommended Conditional Access enforcement. Additional details and guidance on this capability will be communicated in a future update. When will you see this change? Enforcement will now begin starting June 15, 2026 (previously May 13) and will be rolled out progressively over several weeks. You will receive another notification 2 weeks before the rollout and also after the rollout is complete in your tenant. How will this affect your organization? When a user signs in through a client application that requests only the scopes listed above, users may now receive Conditional Access challenges (such as MFA or device compliance) where previously they were allowed access without enforcement. The exact challenge depends on the access controls configured in your policies that target All resources or policies that explicitly target Azure AD Graph as a resource. What do you need to do to prepare? In most cases, no action is required, as most client applications request additional scopes beyond those listed above and are already subject to Conditional Access enforcement. In such cases, there is no change in behavior. If you have custom applications that are intentionally designed to request only the scopes listed above, evaluate whether they can handle Conditional Access challenges such as MFA or device compliance. If they already handle Conditional Access challenges: no changes are required. If they do not, updates may be needed. Refer to the Microsoft Conditional Access developer guidance on how to update your application appropriately.  Additional guidance is now available to help customers prepare for this change. A new configuration is also available to support impacted scenarios, enabling customers to assess impact and transition to the recommended Conditional Access enforcement. Refer to the links below for more details. Additional guidance: https://aka.ms/BaselineScopesSettings URL to access the configuration (Public cloud): https://aka.ms/BaselineScopesSettingsUX URL to access the configuration (US Gov): https://aka.ms/BaselineScopesSettingsUX-gov Learn more:  Conditional Access behavior when an all resources policy has an app exclusion | Conditional Access | Microsoft Learn OpenID Connect scopes - Scopes and permissions in the Microsoft identity platform | Microsoft Entra | Microsoft Learn Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions | Microsoft Entra Blog Compliance considerations No compliance considerations identified. Review as appropriate for your organization.

What changed

Between archive captures, newest first

  1. Updated June 3,July 31, 2026: We have updated the content. Thank you for your patience.  You … links below for more details. Additional guidance: https://aka.ms/BaselineScopesSettings URL to access the configuration:configuration (Public cloud): https://aka.ms/BaselineScopesSettingsUX URL to access the configuration (US Gov): https://aka.ms/BaselineScopesSettingsUX-gov Learn more:  Conditional Access behavior when an all resources policy has an …

  2. Updated May 13,June 3, 2026: We have updated the timeline.content. Thank you for your patience.  You are receiving this message because our … (previously May 13) and will be rolled out progressively over several weeks. You will receive another notification 2 weeks before the rollout and also after the rollout is complete in your tenant. How will this affect your organization? When a user signs in through …

  3. Updated April 15,May 13, 2026: We have updated the content.timeline. Thank you for your patience.  You are receiving this message because our … update. When will you see this change? Enforcement will now begin starting June 15, 2026 (previously May 13, 2026,13) and will be rolled out progressively over several weeks. How will this …

  4. Updated March 20,April 15, 2026: We have updated the timeline and content. Thank you for your patience.  You are receiving this message because … Microsoft Conditional Access developer guidance on how to update your application appropriately.  Additional guidance is now available to help customers prepare for this change. A new configuration is also available to support impacted scenarios, enabling customers to assess impact and transition to the recommended Conditional Access enforcement. Refer to the links below for more details. Additional guidance: https://aka.ms/BaselineScopesSettings URL to access the configuration: https://aka.ms/BaselineScopesSettingsUX Learn more:  Conditional Access behavior when an all resources policy has an …

  5. Updated January 30,March 20, 2026: We have updated the timeline and content. Thank you for your patience.  You are receiving this message because … sign-ins, even when resource exclusions are present. Read more about this change. WhenIn addition, customers who have scenarios that may be impacted by this change will you seehave the ability to retain the current behavior while they assess impact and transition to the recommended Conditional Access enforcement. Additional details and guidance on this change? Microsoft Entra IDcapability will be communicated in a future update. When will begin enforcingyou see this changechange? Enforcement will now begin starting March 27, 2026. ThisMay 13, 2026, and will be rolled out progressively over several weeks until June 2026.weeks. How will this affect your organization? When a user signs in through …

    • Tags Feature update, User impact, Admin impact → Updated message, Feature update, User impact, Admin impact

    Updated January 30, 2026: We have updated the content. Thank you for your patience.  You are receiving this message because our telemetry indicates that you have …

  7. · first version seen

Linked documentation

Microsoft pages the notice links to

Suggested by a shared curated topic and product; not a verified connection (6 items)

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 4 linked pages have not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 26 Oct 11:37 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.