'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Exclude an Application from Conditional Access MFA in Microsoft Entra
Question details
The user wants to configure a Microsoft Entra Conditional Access policy to require MFA for most applications but exclude a specific OpenID Connect application registration.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Configuring multifactor authentication (MFA) policies for enterprise cloud applications while keeping a specific app exempt.
- Observed behavior
- The user needs to set up target resources and exclusions correctly so the excluded app bypasses the MFA requirement without affecting overall security.
Ensure you have at least the Conditional Access Administrator role in Microsoft Entra ID and access to a test user account to verify the policy before organization-wide deployment.
Configure Conditional Access Application Exclusions
Modify or create a Conditional Access policy to explicitly exclude your target cloud application from the MFA requirement.
Conditional Access policies allow you to apply granular access controls. By using the exclusion settings, you can ensure that broad MFA policies do not inadvertently block access to specific applications that use supported authentication flows, such as OpenID Connect.
Log in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
Go to Protection > Conditional Access > Policies. Select your existing MFA policy from the list, or create a new one.
Under the 'Target resources' section of your policy, click on 'Cloud apps or actions'.
Switch to the 'Exclude' tab, click 'Select excluded cloud apps', and search for your specific OpenID Connect application registration. Select it and confirm.
Save the policy in 'Report-only' mode. Test with a pilot group and review the sign-in logs to verify the app is successfully excluded from MFA before switching the policy to 'On'.
Discover WPS Office: A Powerful and Free Office Suite
While Microsoft provides robust enterprise administration tools like Entra ID, navigating their complex software licensing can be costly. If you are looking for a highly compatible, user-friendly alternative to Microsoft Office applications, WPS Office offers a comprehensive suite for Word, Excel, and PowerPoint files at a fraction of the cost.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package.
- 2. Install WPS Office: Run the setup file and follow the simple on-screen instructions to complete the installation.
- 3. Open Your Documents: Launch WPS Office and open your existing Microsoft Office documents directly, with full formatting preserved.
Frequently Asked Questions
Why is my excluded application still prompting for MFA?
This can happen if another active Conditional Access policy targeting the user or app enforces MFA. Review the sign-in logs in Microsoft Entra ID to identify exactly which policy is triggering the prompt.
Can I exclude specific users from the Conditional Access policy instead of the entire app?
Yes. Under the 'Users' section of the Conditional Access policy, you can switch to the 'Exclude' tab to exempt specific users, groups, or directory roles from the MFA requirement.
Does application exclusion work for all authentication flows?
Application exclusion generally works well for interactive flows like OpenID Connect. However, certain legacy authentication protocols or backend service-to-service calls might require different configuration strategies.
