Conditional Access Problems

Require MFA for Azure Portal But Not Outlook in Microsoft Entra

Maira Mehtab Sep 22, 2026 869 views

Question details

The user wants to enforce Multi-Factor Authentication (MFA) for students accessing the Azure portal, while explicitly excluding Outlook from this MFA requirement.

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Configuring access policies for a student group to secure the Azure portal without disrupting their daily email access in Outlook.
Observed behavior: Blanket MFA policies or default security settings are inadvertently forcing students to use MFA for Outlook when the goal is to target only Azure Management.

Before you start

Verify that your tenant has a Microsoft Entra ID P1 or P2 license, as this is required to create and manage custom Conditional Access policies.

Solution 1Recommended

Create a Targeted Conditional Access Policy for Azure Management

Use Microsoft Entra Conditional Access to explicitly target the Microsoft Azure Management cloud application for MFA, leaving other apps like Outlook unaffected.

By specifying exactly which cloud applications require Multi-Factor Authentication, you can secure high-privilege portals without interrupting standard productivity applications.

Access Conditional Access policies

Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator. Browse to Protection > Conditional Access > Policies, and click on 'New policy'.

Assign users or groups

Under the 'Users' section, select the specific groups you want to target, such as your designated 'Students' group.

Target the Azure Management app

Click on 'Target resources' (or Cloud apps or actions). Choose 'Select apps', use the search bar to find 'Microsoft Azure Management', and select it.

Configure the grant controls

Navigate to the 'Grant' section under Access controls. Select 'Grant access', check the box for 'Require multifactor authentication', and click Select.

Test and enable the policy

Set the policy state to 'Report-only' to safely test it with a pilot group. Once you verify that MFA triggers for the Azure portal but not Outlook, change the state to 'On'.

Test with a Pilot Group: Always test new Conditional Access policies on a small pilot group of users before rolling them out to the entire organization to prevent accidental lockouts.

Solution 2

Disable Conflicting Tenant-Wide Settings

Ensure that Security Defaults or legacy per-user MFA settings are not enforcing MFA globally across all applications.

Free Microsoft Office alternative

Document Your IT Policies Seamlessly with WPS Office

While configuring Microsoft Entra policies requires Azure admin tools, documenting your network security guidelines, pilot group test results, and IT workflows is effortless with WPS Office. It provides a lightweight, highly compatible suite that serves as an excellent Microsoft Office alternative for IT professionals.

1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
2. Install and launch: Run the setup file to install the application, then launch WPS Office.
3. Create your documentation: Open a new Document or Spreadsheet to start drafting your IT policies and deployment tracking matrices.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight and fast deployment, perfect for IT administrators needing quick document access.Built-in PDF editing tools for securing and distributing Conditional Access policy documentation.Completely free core features for drafting and sharing IT security guidelines.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Outlook still prompt for MFA after I configured a policy only for Azure?

This usually happens if 'Security Defaults' are enabled in your Microsoft Entra tenant, or if another Conditional Access policy targets 'All cloud apps'. You must disable Security Defaults to rely solely on your custom granular Conditional Access policies.

Can I exclude Outlook specifically from an 'All Apps' MFA policy?

Yes. In your Conditional Access policy under 'Target resources', you can select 'All cloud apps' in the Include section, and then add 'Office 365 Exchange Online' to the Exclude section to prevent MFA prompts specifically for Outlook.

What licensing is required to configure specific apps for MFA in Azure?

To create and manage granular Microsoft Entra Conditional Access policies (such as targeting only Azure Management), your tenant requires a Microsoft Entra ID P1 or P2 license.

How do I ensure I don't lock myself out while configuring these policies?

It is best practice to exclude at least one 'break-glass' or emergency access administrator account from all Conditional Access policies. Additionally, always use the 'Report-only' mode to test new policies before enforcing them.

Microsoft Office Security Issues