Conditional Access Problems

How to Fix Unable to Edit Microsoft-Managed Conditional Access Policy

Maira Mehtab Sep 20, 2026 869 views

Question details

The user is unable to modify an existing Conditional Access policy because the system restricts editing, indicating that it is a Microsoft-managed policy.

Product: Microsoft Entra ID (Azure AD)
Device & OS: not provided
Scenario: Attempting to customize or modify security and access rules within the admin center.
Observed behavior: The policy editing options are greyed out or locked, and a message appears stating the policy is Microsoft-managed.

Before you start

Ensure you are logged in with an account that has at least the Conditional Access Administrator or Global Administrator role in your Microsoft Entra ID tenant.

Solution 1Recommended

Verify Administrator Permissions and Review Policy Documentation

Confirm whether your account has the correct administrative roles and understand the specific limitations applied to Microsoft-managed policies.

Microsoft-managed policies are default security rules or predefined conditional access templates created by Microsoft. By design, some of these policies are strictly read-only to prevent accidental lockouts or security vulnerabilities. It is highly recommended to verify your permissions first before assuming there is a system error.

Log in to the Admin Center

Check Role Assignments

Navigate to 'Identity' > 'Roles and admins' > 'Roles and administrators'. Search for 'Conditional Access Administrator' and verify that your account is listed.

Review Policy Properties

Go to 'Protection' > 'Conditional Access' > 'Policies' and select the locked policy. Look for a banner or warning message explaining the Microsoft-managed status.

Consult Official Documentation

Click any provided documentation links within the policy warning to see if this specific rule is a mandatory security default that cannot be altered.

Security Defaults Limitation: If your tenant has 'Security Defaults' enabled, standard Conditional Access policies may be managed entirely by Microsoft and locked from manual editing.

Solution 2

Create a Custom Policy or Escalate to Microsoft Support

If the default Microsoft-managed policy does not meet your organizational requirements, create a new custom policy to supersede it or contact support.

Free Microsoft Office alternative

Looking for a Free and Lightweight Office Suite Alternative?

While complex backend administrative tasks like managing Conditional Access require Microsoft's infrastructure, handling your daily documents doesn't need to be expensive or complicated. WPS Office provides a powerful, lightweight, and completely free alternative to Microsoft Office for creating, editing, and sharing your documents, spreadsheets, and presentations.

1. Download the Installer: Visit the official WPS website and click the Free Download button for your operating system.
2. Install and Launch: Run the downloaded installer file and follow the quick setup wizard.
3. Open Existing Files: Launch WPS Office and directly open your existing Microsoft Word, Excel, or PowerPoint files without losing formatting.

Fully compatible with Microsoft Office formats, including DOCX, XLSX, and PPTX.Lightweight installation that runs incredibly smoothly, even on older devices.Familiar tabbed user interface ensuring absolutely zero learning curve.Built-in PDF editing, conversion, and splitting tools at no extra cost.

microsoft office alternative - wps office

Frequently Asked Questions

What exactly is a Microsoft-managed Conditional Access policy?

It is a predefined security policy created and automatically maintained by Microsoft. These are often deployed as part of tenant 'Security defaults' to protect organizations from common identity-based attacks out of the box.

Can I completely disable a Microsoft-managed policy?

You generally cannot disable individual Microsoft-managed policies if they are tied to Security Defaults. To gain full manual control over Conditional Access, a Global Administrator must disable Security Defaults in the Microsoft Entra properties, which then allows for custom policy enforcement.

Why is the edit button completely greyed out in my Conditional Access portal?

The edit button is greyed out either because your user account lacks the necessary administrative permissions (such as Conditional Access Administrator) or because the specific policy is hardcoded as read-only by Microsoft to ensure baseline security.

How do I duplicate a locked Conditional Access policy?

You cannot directly clone a locked Microsoft-managed policy using a simple duplicate button. Instead, you must manually create a 'New policy' and configure the exact same user assignments, conditions, and grant controls to replicate its behavior.

Microsoft Office Security Issues