June 2026 Conditional Access changes: what MSPs must check now
Microsoft is enforcing two Conditional Access changes in June 2026 that can break automation and mobile controls: All-resources policies with exclusions begin enforcing on June 15, and the 'Require approved client app' grant retires June 30. Here’s a short audit-and-remediation checklist for MSPs.
June 15, 2026 and June 30, 2026 are two hard dates every MSP managing Entra/Conditional Access should have on the calendar.
What changed (short):
- Starting June 15, 2026, Conditional Access policies that target All resources will be enforced for sign-ins that previously bypassed them when the policy had resource exclusions, specifically sign-ins requesting only OIDC or a small set of directory scopes (openid, profile, email, offline_access, User.Read, etc.).
- On June 30, 2026, Microsoft retires the Require approved client app grant control. Policies that rely only on that grant will no longer enforce it. The migration target is Require app protection policy.
Why this matters for MSPs
- Automation, management scripts, custom apps or CLI commands that assumed those sign-ins were exempt may start seeing MFA/device checks or fail entirely.
- Mobile access controls that depended on the approved-app list can silently lose protection if you don’t migrate before June 30.
Quick audit-and-fix checklist
- Inventory: list tenants with Conditional Access policies targeting All resources that have resource exclusions. Use Microsoft Graph / Graph PowerShell to export CA policy definitions.
- Identify affected sign-ins: query sign-in logs for OIDC and limited-scope requests (openid/profile/email/offline_access/User.Read).
- Test in Report-only: enable report-only for changed policies to observe impacts before enforcing.
- Migrate mobile policies: replace Require approved client app with Require app protection policy. Use the dual-grant pattern (Require one of the selected controls) while testing.
- Update automation: convert client flows to service principal auth or update apps to request broader scopes, and ensure they can respond to Conditional Access challenges.
Practical takeaway Run this audit across your tenant estate this week: find CA policies with "All resources + exclusions", flip them to report-only, test sign-ins and automation, then enforce. Want a checklist you can run across dozens of tenants? That’s exactly the kind of drift TenantForge flags so you can remediate at scale.
What did you find when you started hunting for "All resources" policies in your fleet, lots of old exclusions, or mostly clean?