Default Conditional Access Policy Not Applied to New Users

Question

Default Conditional Access Policy Not Applied to New Users

Francesco Gatto 20

I have enabled Microsoft's default Conditional Access policy, but I noticed that it is not applied to all users. Specifically, the policy seems to include only users added up to a certain date, while those created afterward are not recognized.

Additionally, when using the "What If" tool, the policy appears as "Excluded" for these new users, even though I haven't manually configured any exclusions.

I also noticed that the "Users and groups" parameter was automatically flagged by the policy, so there shouldn't be any implicit exclusions.

Has anyone else experienced this issue? Is there a way to force the policy to apply to all users, including those created after its activation?

Thanks in advance for your support!

Sakshi Devkante 1,335 Reputation points Microsoft External Staff

2025-03-11T11:04:24.15+00:00

Hello Francesco,

The scope of the Conditional Access policy is frequently determined by user categories or characteristics. It's probable that the policy was first set up for particular groups (like those that were in existence when the policy was made). Make sure that new users are automatically added to the appropriate groups if the policy depends on group membership in order for it to be effective.

Double-check if the policy is scoped to any specific Azure AD groups. If so, verify that the new users are included in these groups.

Review dynamic group membership rules, if applicable, to ensure new users are included.
There might be a delay in the policy being applied to new users, especially if there was a recent update or change in the tenant configuration.

Your answer

Sakshi Devkante 1,335 Reputation points Microsoft External Staff

2025-03-11T11:04:24.15+00:00

Hello Francesco,

The scope of the Conditional Access policy is frequently determined by user categories or characteristics. It's probable that the policy was first set up for particular groups (like those that were in existence when the policy was made). Make sure that new users are automatically added to the appropriate groups if the policy depends on group membership in order for it to be effective.

Double-check if the policy is scoped to any specific Azure AD groups. If so, verify that the new users are included in these groups.

Review dynamic group membership rules, if applicable, to ensure new users are included.
There might be a delay in the policy being applied to new users, especially if there was a recent update or change in the tenant configuration.

Share via

Default Conditional Access Policy Not Applied to New Users

Your answer