Improved enforcement for *All resources* policies with resource exclusions

Why it matters: Generally available

Microsoft Entra Conditional Access is strengthening how policies that target All resources with resource exclusions are enforced in a narrow set of authentication flows. After this change, in user sign‑ins where a client application requests only OIDC or specific directory scopes, Conditional Access policies that target All resources with one or more resource exclusions, or policies that explicitly target Azure AD Graph, will be enforced. This ensures that policies are consistently applied regar

Affected: Microsoft Entra ID, Conditional Access

View at Microsoft → Copy summary