Conditional Access enforcement changes June 15: check your exceptions now
Apps could bypass Conditional Access by requesting minimal sign-in scopes. Non-excluded apps slipped through silently for years. Starting June 15, that stops.
Apps requesting only basic sign-in scopes have been silently bypassing Conditional Access for years, not because they were excluded, but because Microsoft’s own policy evaluation skipped the check. That closes starting June 15, 2026 (confirmed June 14; originally announced for May 13, then pushed to June 15 via the Microsoft Entra Tech Community blog).
Key Takeaways
- Sign-ins requesting only
openid,profile,User.Read(and similar basic scopes) have been bypassing CA enforcement, even on non-excluded apps- Rollout starts June 15, 2026, phased over several weeks
- You’re affected only if your CA policy targets All resources AND has resource exclusions configured. Check Message Center for MC1223829 to confirm
- Non-interactive automation (scripts, service accounts) fails outright, no error. Interactive tools like VS Code and Azure CLI just get a new MFA prompt
- A Baseline scopes settings page lets you enable enforcement early, exempt specific policies, or (not recommended) disable it tenant-wide
Are you affected?
Check all three: your CA policy targets All resources, it has resource exclusions configured, and non-excluded apps exist that request only basic scopes. All three true → those apps get checked for the first time starting June 15. Search MC1223829 in the Microsoft 365 admin center to confirm Microsoft already flagged your tenant.
The highest-risk case: non-interactive scripts and service accounts authenticating with minimal scopes (User.Read, openid) will fail outright once enforcement reaches your tenant, no prompt, no fallback. Interactive sign-ins (VS Code, Azure CLI) just get an unexpected MFA prompt instead.
Check this before June 15
- Confirm MC1223829 applies to your tenant, then review CA policies targeting All resources with exclusions
- Test whether affected apps actually handle an MFA challenge (sign in from an unfamiliar network); legacy/in-house apps often don’t and will fail silently
- Move non-interactive automation to a service principal (excluded from user-scoped CA by default), or document an explicit exclusion with a review date
- Control the rollout yourself via Baseline scopes settings: enable early to test, scope an exemption to one policy via a placeholder app, or (last resort) disable tenant-wide
- Check Intune/Jamf and Azure Virtual Desktop sign-in flows too if you use them
Check it automatically
Before enforcement: Get-CAEnforcementReport.ps1 lists your relevant CA policies and flags legacy-auth sign-ins that will break. After: Get-CAEnforcementMonitor.ps1 cross-checks sign-in logs against the week before rollout to show what genuinely changed. Both output an HTML report, delegated permissions only.
Frequently asked questions
What happens if I don’t act? Most users just get prompted for MFA once, call the helpdesk, done. Automation and legacy integrations that can’t handle an MFA challenge fail outright with no fallback, before June 15 is when to catch those.
My tenant isn’t in Message Center for MC1223829. Am I in scope? Likely not. Microsoft has already notified tenants that meet the three affected-conditions above; no notification is a reasonable (not absolute) signal you’re clear.