Conditional Access Problems

How to Fix Exchange Online PowerShell Conditional Access Sign-In Failure

Camila Milosovich Oct 10, 2026 869 views

Question details

The user is unable to authenticate to Exchange Online via PowerShell because a Conditional Access policy blocks the connection for not meeting the hybrid-joined device requirement.

Product: Exchange Online
Device & OS: not provided
Scenario: Attempting to run Connect-ExchangeOnline in a PowerShell session within an environment that enforces strict device-based Conditional Access policies.
Observed behavior: The system prompts for multi-factor authentication (MFA) but ultimately denies access, stating the device is not hybrid-joined, despite the user wanting to comply without bypassing the policy.

Before you start

Ensure you have access to the Microsoft Entra ID (Azure AD) portal with Security Reader or Conditional Access Administrator privileges to review detailed sign-in logs.

Solution 1Recommended

Verify Device Registration and Review Entra ID Sign-in Logs

Analyze the authentication failure at the source to confirm whether the device is failing the hybrid-join check or if the PowerShell session is failing to pass the device claims.

Conditional Access policies rely on the Primary Refresh Token (PRT) to verify device state. If the PowerShell module does not support modern authentication broker integration, it will fail to prove the device is hybrid-joined.

Check local device status

Open a Command Prompt on the affected machine and type 'dsregcmd /status'. Verify that both 'AzureAdJoined' and 'DomainJoined' are set to YES.

Access Entra ID sign-in logs

Log into the Microsoft Entra admin center. Navigate to 'Identity' > 'Monitoring & health' > 'Sign-in logs'.

Locate the failed PowerShell login

Filter the logs by the affected user and locate the 'Interrupted' or 'Failed' status associated with the Exchange Online PowerShell application.

Analyze Conditional Access details

Click on the failed log entry, switch to the 'Conditional Access' tab, and click 'Show Details' on the policy that failed to see exactly which condition (e.g., Require Hybrid Azure AD joined device) was not met.

Verify Device Registration and Review Entra ID Sign-in Logs

Administrator Privileges: If the device is correctly hybrid-joined but the logs show it as unregistered, the issue lies in how PowerShell is passing authentication tokens.

Solution 2

Update to Exchange Online PowerShell V3 Module

Older PowerShell modules do not properly support Web Account Manager (WAM), which is required to pass device claims for Conditional Access.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While you manage complex IT environments, Azure policies, and Exchange configurations, your end-users need a reliable and straightforward office suite. WPS Office is a highly compatible, free alternative to Microsoft Office that simplifies daily document tasks without the heavy administrative overhead.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the Software: Run the lightweight setup file. Installation takes only a few minutes and requires minimal configuration.
3. Open and Edit Files: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office documents without formatting loss.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation that doesn't burden system resources or require complex deployment scripts.Free to use with a familiar, easy-to-learn tabbed interface.Reduces the need for complex enterprise deployment policies for basic document editing.

microsoft office alternative - wps office

Frequently Asked Questions

Why does PowerShell fail to recognize my hybrid-joined device?

PowerShell sessions may fail to recognize hybrid-joined status if they do not integrate with the Windows Web Account Manager (WAM). This prevents the Primary Refresh Token (PRT), which contains your device claims, from being passed to Azure AD. Updating to the latest Exchange Online module resolves this.

Can I exclude a specific admin from this Conditional Access policy?

Yes. Administrators can exclude specific users or roles in the Microsoft Entra admin center under the policy's 'Users' section. However, modifying the policy to bypass security requirements is not recommended unless absolutely necessary for emergency access.

How do I check if my Windows device is hybrid Azure AD joined?

Open the Command Prompt on your computer and run the command 'dsregcmd /status'. Look under the 'Device State' section to ensure that both 'AzureAdJoined' and 'DomainJoined' are listed as 'YES'.

Microsoft Office Security Issues