Troubleshooting: Sign-In Fails Due to Entra ID Conditional Access (All Cloud Apps)

Version Affected: All

 

Overview

Sign-in to a realm using an Entra ID datastore can fail when a Conditional Access policy in Entra ID is configured to require MFA for "All Cloud Apps".

Cause

When a Conditional Access policy in Entra ID requires MFA for All Cloud Apps, this includes the SecureAuth application registration. The SecureAuth application in Entra ID is configured as a public client:

Because it is a public client, the SecureAuth application cannot be excluded from Conditional Access, as documented in Microsoft's Conditional Access cloud apps, actions, and authentication context article. This means the "All Cloud Apps" policy applies to sign-in through SecureAuth as well, and blocks it if the user cannot satisfy Entra ID's own MFA requirement in that context.

Resolution:

In Entra ID, edit the Conditional Access policy and explicitly add every cloud application in the tenant that should require MFA, instead of selecting the All Cloud Apps option.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.