You’re offline. This is a read only version of the page.
40
Hi,
From the screenshots and sign‑in logs:
In other words, GP is authenticating to Microsoft Graph successfully (you pass MFA), but access is blocked by the customer’s Conditional Access rules, not by GP or the Graph registration.
These are all changes the customer’s Entra ID / Intune security team must make on their tenant—the blocking policy lives there.
How (high level):
Entra ID ▸ Security ▸ Conditional Access ▸ Policies ▸ [policy that requires compliant device] ▸ Assignments ▸ Users and groups ▸ Exclude (add the dedicated service account or group). Test in Report‑only first. [3]
Binding GP to a single account lets the customer exclude only that identity (or the GP app) instead of every user. That’s a common, least‑privilege compromise when a tenant doesn’t permit registering third‑party‑hosted devices. Microsoft’s CA guidance specifically recommends excluding service accounts from user‑scoped policies and managing apps with workload‑identity CA if needed. [3]
Observed: Sign‑in error 53000; device state Unregistered; CA requires “Require device to be marked as compliant.”
Ask (choose one):
1) Exclude [service account or security group] (or the GP app registration) from the “Require compliant device” control; keep MFA and restrict by Named locations (our static public IPs). [3]
2) Change the grant control to allow MFA as an alternative to device compliance for this scenario, or apply a device filter that doesn’t block GP’s host. [3][4]
3) Permit our GP host to be Entra‑joined and Intune‑enrolled so it becomes compliant. The error 53000 description confirms this resolves the block. [1]
Testing tip: Put the modified policy in Report‑only first, validate in Sign‑in logs, then enable. [3]
If this addresses the problem, please mark the reply so others can find it.
Thanks and best regards,
Daniele
Note: This response was prepared with support from Copilot to ensure clarity and completeness.
Share
Report
All responses (
Answers (
