Azure Conditional Access not applying to token acquisition requests?

2
votes

In MS Azure does Conditional Access apply to scenarios where you acquire an access token towards an application programmatically/non-interactively (for example using ADAL or manually via token endpoint)?

I have a Web App in Azure with Azure AD Authentication/Easy Auth configured and a Conditional Access Policy applied/targeting the application.

When attempting to access the Web App interactively in a browser, the Conditional Access Policy applies as expected.

When I attempt to acquire an access token for the same application using a Service Principal programmatically/non-interactively (client credentials grant/flow) the Conditional Access Policy targeting the application does not seem to apply and I can acquire tokens from any location as well as use them from any location.

I do not see any related settings in Conditional Access within Azure which would ensure policies are applied to specific grant scenarios/flows or just interactive processes.

Which leads me to ask does anyone know if Condition Access policies apply to such grants/flows that are executed non-interactively?

1
azureazure-active-directoryaccess-tokenadal

1 Answers

1
votes

I do not see any related settings in Conditional Access within Azure which would ensure policies are applied to specific grant scenarios/flows or just interactive processes.

You're right. It can only work for user interface authentication. Though it may not be made clearly in the documentation.

First, Conditional Access has some requirements:

You can use Azure AD conditional access to protect cloud apps when an authentication attempt comes from:

  • A web browser

  • A client app that uses modern authentication

  • Exchange ActiveSync

A client app that users modern authentication: This is based on ADAL. So, it also needs user sign in.