A new hire scoped a Conditional Access block for legacy authentication to All cloud apps and accidentally disrupted directory token flows the team still needed. How should Azure management access be targeted instead while keeping emergency accounts usable?
Select an answer to reveal the explanation.
Short Explanation
“All resources” is a wide net—great for some controls, clumsy when you only meant Azure management. Aim the policy at Windows Azure Service Management API for portal/ARM work, and always leave your break-glass accounts outside the net.
Full Explanation
Conditional Access target resources distinguish All cloud apps from specific apps such as Windows Azure Service Management API used for Azure portal and ARM operations. Over-scoping a legacy authentication block to All cloud apps can affect other token scenarios the directory still requires. Emergency (break-glass) accounts must be excluded so administrators can recover if a policy misbehaves. Azure Policy and Defender for Cloud do not replace Conditional Access app targeting for this identity control.