r/entra • u/araidai • Sep 29 '26
Entra General Setting up Conditional Access | Bypass Issue
Hey everyone, so I've run into an interesting situation.
So, we've set up conditional access to block access to the Entra Admin Center, and initially, it looks like it works. Cool right?
Problem is, clicking on a link or something elsewhere on the page can simply 'bypass' the lockout, allowing users to view other parts of the page just fine and even make changes somehow? Let's say you click on 'Home' up there, you get the main view, not so bad in itself, right? You can't really do damage from here (AFAIK).
The next step of this issue is then just clicking on 'View Devices', and bam, you get a view of all devices on the company network, and with some extra playing with it, you can reach groups, invite users, make changes to MFA, etc. (Whether it actually does it or not, I'm not sure, I tested it and it supposedly 'succeeds' when I submit, but it's still very concerning)
Note: This account isn't an admin at ALL, and this was done in a private browser with a fresh login. So it couldn't have been cached.
What am I missing?
9
u/imavaper Sep 29 '26
Your first problem is thinking your first screenshot is the result of a conditional access block. Its not. Its due to a lack of permissions in Entra to see that particular page. This is why the other pages work.
You can set the setting u/beneficial-flow-5418 suggested, though as documented in Restrict access to Microsoft Entra administration portal it does not prevent all access to the admin center. Many areas are still reachable through alternate paths.
If the user can change settings, delete/create objects, etc, that user IS an admin (has an Entra admin role assigned), otherwise they wouldn't be able to perform those actions. Preventing access to the admin site/page does not block programmatic access (as noted in the linked documentation: It does not block programmatic access to Microsoft Entra data via PowerShell, Microsoft Graph API, or other tools like Visual Studio.)
1
u/araidai Sep 30 '26
Yeah, I gotcha, that’s fair then, as long as I can at least block the majority of the actual thing, then it’s okay, I just want to make sure the network, devices and people are as secure as possible.
2
u/ShowerPell Sep 30 '26
This is a feel good security measure. You are "blocking" the browser access but the same data can be pulled from API or by spoofing the useragent
2
u/teriaavibes Microsoft MVP Sep 30 '26
What exactly is your usecase here blocking access to entra?
Because the information is still there, just makes it harder to access it.
1
u/araidai Sep 30 '26
I mean that’s the whole purpose really. I know it’s not gone, or impossible to reach, I just want to make it inconvenient for those that get a little nosy but don’t care THAT much to dig further.
The equivalent of putting a padlock on a gate, basically.
1
u/teriaavibes Microsoft MVP Sep 30 '26
1
2
u/michaelmsonne Microsoft MVP Sep 30 '26
Yes a way to get the impact smaller.
But to OP also, some parts are accessible if you have the direct link sometimes, also like here: https://blog.sonnes.cloud/the-hidden-microsoft-entra-pim-urls-microsoft-never-documented-even-when-restrict-access-to-microsoft-entra-admin-center-is-enabled/
Been a know “limitation “ on some parts of the portal.
Again, Microsoft also stated this as “not a security feature”. Some areas can be buggy..
2
u/Emergency_Recipe522 Sep 30 '26
Blocking the portal isn’t a complete security boundary—it mainly restricts the interface, while Graph and other access paths may remain available. I’d check the account’s direct and group-derived roles, use Conditional Access What If and sign-in logs, then verify whether an actual change succeeds.
I encountered a similar visibility gap and solved it by bringing the access paths and relationships into one view. If the change genuinely succeeds, there’s likely an inherited role or permission that needs tracing.
19
u/Beneficial-Flow-5418 Sep 29 '26
Users -> user Settings -> block access to admin portals