Plan for Change: "Require approved client app" control in Azure AD Conditional Access will be retired in March 2026
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.What the notice says
Microsoft’s text, safely structuredIn March 2026, Azure Active Directory (Azure AD) and Microsoft Intune will retire the Conditional Access “Require approved client app” grant control. Instead we recommend utilizing the "Require application protection policy" grant control, which provides the same data loss and protection with additional benefits.
How this will affect your organization
If you have a Conditional Access policy with "Require approved client app" grant control configured, after this change, you will no longer be able to enforce this control, it will be as if this grant is not selected.
What you need to do to prepare
We recommend updating your Conditional Access policy to using the "Require application protection policy" grant control. For more information, see Migrate approved client app to application protection policy in Conditional Access.
What changed
Between archive captures, newest first… control, which provides the same data loss and protection with additional benefits.
How[How this will affect yourorganization:organization:] If you have a Conditional Access policy with "Require approved client app" … this control, it will be as if this grant is not selected.What[What you need to do toprepare:prepare:] We recommend updating your Conditional Access policy to using the "Require application …- · first version seen
Learn more
Links from the notice and their documentation checksRelated public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- 1 linked page has not been read yet.