Fix Azure Conditional Access Blocking SharePoint on Azure AD Joined Devices
Question details
Users are blocked from accessing SharePoint via web and desktop clients due to a Conditional Access policy enforcing hybrid Azure AD-joined devices, despite test devices being Azure AD joined.
- Product
- Microsoft SharePoint / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Attempting to access SharePoint resources from an Azure AD joined test device under a strict Conditional Access policy.
- Observed behavior
- The Conditional Access policy denies access to SharePoint, prompting an access blocked error on both desktop apps and web browsers.
Ensure you have Conditional Access Administrator privileges in Microsoft Entra ID and verify that your tenant has the required Microsoft Entra ID P1 licensing to evaluate these policies.
Verify Device State and Adjust Policy Grant Controls
Check the Microsoft Entra admin center to confirm the device join type and modify the Conditional Access policy to allow standard Azure AD joined devices.
Conditional Access policies can strictly require a 'Hybrid Azure AD joined' state. If your devices are only 'Azure AD joined', they will fail this check and be blocked. Adjusting the grant controls to accept compliant Azure AD joined devices resolves this conflict.
Sign in to the Microsoft Entra admin center, navigate to Identity > Devices > All devices, and verify if your test devices are listed as 'Azure AD joined' rather than 'Hybrid Azure AD joined'.
Navigate to Protection > Conditional Access > Policies and open the specific policy that manages SharePoint access.
Under the 'Grant' section, review the required controls. If 'Require Hybrid Azure AD joined device' is checked, consider checking 'Require device to be marked as compliant' instead, and ensure the policy is set to 'Require one of the selected controls'.
Go to Monitoring & health > Sign-in logs to verify the exact policy and condition that caused the initial block, ensuring your changes directly address the failure.
Configure Browsers to Pass Device Identity
Ensure web browsers are configured to correctly pass the device identity token to Azure AD so the Conditional Access policy recognizes the device state.
Simplify Your Document Workflow with WPS Office
While complex IT policies like Azure Conditional Access are necessary for securing cloud platforms like SharePoint, managing everyday documents shouldn't be complicated. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office, allowing you to edit files locally and avoid cloud access barriers.
- 1. Download the software: Visit the official WPS Office website and click the free download button.
- 2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions.
- 3. Start working instantly: Open your existing Office documents and start editing offline or online without complicated access configurations.
Frequently Asked Questions
What is the difference between Azure AD joined and Hybrid Azure AD joined?
Azure AD joined devices are registered and managed entirely in the cloud directory. Hybrid Azure AD joined devices are joined to an on-premises Active Directory and also registered with Microsoft Entra ID (Azure AD) in the cloud.
Can I enforce Conditional Access with Microsoft 365 Business Standard licenses?
Microsoft 365 Business Standard does not natively include the Microsoft Entra ID P1 license required to create and enforce Conditional Access policies. You must purchase the P1 add-on or upgrade to Microsoft 365 Business Premium.
How do I find out exactly which Conditional Access policy is blocking a user?
Administrators can find this by logging into the Microsoft Entra admin center, navigating to the Sign-in logs, selecting the specific blocked sign-in event, and checking the 'Conditional Access' tab for detailed policy evaluation results.
