Conditional Access Problems

How to Block AI Mail Apps from Microsoft 365 Authentication

Maira Mehtab Sep 27, 2026 869 views

Question details

The user needs to prevent third-party AI-enabled mail applications, such as Canary Mail and Spark, from authenticating with their Microsoft 365 environment.

Product: Microsoft 365
Device & OS: not provided
Scenario: Securing a Microsoft 365 organization by restricting unauthorized third-party mail applications from accessing corporate data.
Observed behavior: Despite some existing protection policies, targeted AI mail apps continue to request administrator approval or authenticate successfully.

Before you start

Ensure you have Global Administrator or Conditional Access Administrator privileges in Microsoft Entra ID before modifying enterprise application permissions and consent settings.

Solution 1Recommended

Revoke Permissions and Restrict Consent in Entra ID

Remove existing access for unwanted AI mail apps and prevent users from granting them consent in the future.

To completely block third-party applications from accessing your tenant, you must first revoke any previously granted permissions and then restrict future consent requests.

Navigate to Enterprise Applications

Locate and Modify Unwanted Apps

Search for specific apps like 'Canary Mail' or 'Spark'. Select the application, navigate to Permissions, and revoke any granted permissions.

Disable User Sign-in

Go to Properties within the app's settings, toggle 'Enabled for users to sign-in' to No, and save your changes. Alternatively, you can delete the application entirely.

Restrict User and Admin Consent

Navigate to Enterprise applications > Consent and permissions. Adjust the user consent settings to prevent users from granting consent to unapproved apps, and manage admin consent workflow settings if necessary.

Important: Disabling the application prevents any future authentication attempts by the app using the same application ID.

Solution 2

Block Apps Using Conditional Access Policies

Create a Conditional Access policy to explicitly block authentication attempts from unauthorized client applications.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Alternative to Microsoft Office?

While you manage complex security configurations in your Microsoft 365 environment, you might be looking for a simpler, cost-effective solution for your daily productivity needs. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office, ensuring seamless document management without enterprise overhead.

1. Download WPS Office: Visit the official WPS website to download the free installer.
2. Install and Run: Follow the simple installation wizard to set up the software.
3. Open Your Files: Seamlessly open and edit all your existing Word, Excel, and PowerPoint files.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Lightweight design ensuring fast installation and smooth operation on any device.Familiar user interface requiring zero learning curve for seamless migration.Completely free core features for Writer, Spreadsheet, and Presentation.

microsoft office alternative - wps office

Frequently Asked Questions

Why do apps like Spark and Canary Mail still ask for admin approval after being blocked?

If admin consent workflows are still active in Entra ID, applications will continue to prompt administrators for approval even if standard user consent is disabled. You must explicitly block the enterprise application and disable the admin consent requests for these specific apps.

Can I block only the AI features while allowing the mail app to function?

Microsoft Entra ID Conditional Access evaluates authentication requests for the entire application, not individual internal features. To block the AI capabilities of third-party mail apps, you generally have to block the entire application.

What happens to users currently signed into a blocked mail app?

Once application permissions are revoked and a blocking policy is enforced, active sessions will be terminated upon the next token refresh, and users will be immediately locked out of the application.

Microsoft Office Security Issues