Loading...

Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins

Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins

Microsoft Entra requires updating Conditional Access policies by September 4, 2025, to explicitly include Azure DevOps (App ID: 499b84ac-1321-427f-aa17-267ca6975798) for secure sign-ins. Policies targeting the Windows Azure Service Management API will no longer protect Azure DevOps access. Microsoft Entra ID P1 or higher license is needed. Introduction Microsoft Entra is updating how Conditional Access (CA) policies apply to Azure DevOps sign-ins. Azure DevOps will no longer rely on the Azure Resource Manager (ARM) resource during sign-in or token refresh flows. This change ensures that access controls are applied directly to Azure DevOps. Organizations must update their Conditional Access policies to explicitly include Azure DevOps to maintain secure access. When this will happen This change will take effect starting September 2, 2025, and will be fully enforced by September 4, 2025, across all environments. How does this affect your organization? If your organization has Conditional Access policies targeting the Windows Azure Service Management API (App ID: 797f4846-ba00-4fd7-ba43-dac1f8f63013), those policies will no longer apply to Azure DevOps sign-ins. This may result in unprotected access unless these policies are updated to include Azure DevOps (App ID: 499b84ac-1321-427f-aa17-267ca6975798). Access controls such as MFA or compliant device requirements may not be enforced unless policies are updated. If you already have a policy that targets all users and all cloud apps and does not explicitly exclude Azure DevOps, no action is required—Azure DevOps sign-ins will continue to be protected. This change does not introduce any new user-facing experience or UI changes. Sign-in activity can be monitored using Microsoft Entra ID sign-in logs. Licensing requirement: Microsoft Entra ID P1 or P2 is required. There are no functional differences by license type. This is a feature change, not a new feature, so trial or preview options are not applicable. Unlicensed users may also be impacted. Existing Conditional Access policies will be affected, specifically those targeting the Windows Azure Service Management API. A small subset of tenants may see the app name as “Microsoft Visual Studio Team Services” instead of “Azure DevOps”—the App ID remains the same. Learn more:  What do you need to do to prepare? To ensure […]

The post Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins appeared first on M365 Admin.

Published on:

Learn more
Need help with this product?

We can help you with Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins

If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.

M365 Admin
M365 Admin

by João Ferreira

Share post:

Related posts

Intune: Windows Health Attestation Migration to Microsoft Azure Attestation

Microsoft Intune will migrate Windows Health Attestation compliance evaluation from the current Device Health Attestation (DHA) service to Mic...

3 days ago

Dynamics 365 Commerce – Print receipts using Adyen payment terminal printers

We are announcing the ability to print receipts using the built-in printer on supported Adyen payment terminals in Dynamics 365 Commerce. This...

3 days ago

Outlook: Multi Account Search

Users will be able to see results from multiple mailboxes interweaved in a single ranked list and will be able to do standard mail actions. Pr...

3 days ago

Dynamics 365 Field Service: Manage rental service demand with work order requests

Rental organizations need to coordinate commercial rental activity, equipment availability, asset condition, and service execution across mult...

3 days ago

Microsoft Teams: Schedule Channel Meetings from Outlook Calendar

Users will be able to schedule Microsoft Teams channel meetings directly from Outlook Calendar. This streamlines meeting creation and helps ke...

3 days ago

Microsoft 365 admin center: Optional Public CDN Support in Brand Center Setup

We are updating the Brand Center setup experience so that administrators can set up Brand Center without enabling Public CDN. Today, Public CD...

3 days ago

Dynamics 365 Field Service: Book Work Orders with Multiple Requirements

Dispatchers can now select which resource requirement to schedule when booking a work order that has multiple requirements. The new Book exper...

3 days ago

Brand Skill support now available in PPT Copilot [Web]

Brand managers can upload custom presentation skills as Markdown files to Brand Kit for use with Copilot in PowerPoint Web, enabling consisten...

4 days ago

Brand Skill support now available in PPT Copilot [Desktop]

Brand managers can now upload custom presentation skills as Markdown files to Brand Kit for use with Copilot in PowerPoint Desktop, enabling c...

4 days ago

Newsletter

Get the latest Dynamics 365 and Power Platform content in your inbox

A curated digest of community blogs, product news, videos, and podcasts — delivered without the noise.

Weekly updates Unsubscribe anytime Fresh community picks
We use your email only for the newsletter and you can unsubscribe at any time.
By subscribing, you agree to the privacy policy.