This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 98%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBL%3C/text%3E%3C/svg%3E)
Hi, I've registered a new app using "App registration" and it is showing as an application in under the "Enterprise applications" tab in Microsoft Entra ID. I want to excluded this app from mfa in Conditional Access, but I can't find the app when I search for it in "Select excluded cloud apps. I'm a bit confused into why this is. Thanks,
A cloud-based identity and access management service for securing user authentication and resource access
Some apps wont show up individually if you sure you cant find it.
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#other-applications
Hi Andy, thank you for your reply. So how would I exclude this app from MFA if I can't find it?
Thank you for your post!
I understand that you're having issues excluding your App from your Conditional Access policy, even though you're able to view it under the respective App Registration and Enterprise application tab(s).
I wasn't able to reproduce your issue, but to hopefully help point you in the right direction:
Additional Links:
If you're still having issues and would like to work with our support team to get this issue resolved, please let me know.
I hope this helps! Thank you for your time and patience throughout this issue.
If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Hi James, thank you for your post. Have sorted it. Ended up using Custom Security Attributes
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(243.2, 54%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJH%3C/text%3E%3C/svg%3E)
I know this is an older post, but this issue still exists and is not easy to get sorted. What I found is that I have to give the application specific API permissions. For me it was granting Microsoft Graph at least User.Read permission, but sometimes it seems it may also need 'email', 'openid', and 'profile' permissions. Once I added these then it showed up as a resource in Conditional Access policies. Here are Claude generated steps for this issue:
Fix: Custom Enterprise Application Not Showing in Conditional Access "Cloud Apps" Picker
You have a custom app registered in Entra ID (Azure AD), and its Enterprise Application (service principal) object already exists — you can see it under Enterprise Applications — but when you go to create or edit a Conditional Access policy and try to select it under Cloud apps > Include/Exclude > Select apps, it doesn't appear in the picker, even when searching by name.
HideApp or similar tag presentApplication, not ManagedIdentity/LegacyAdd at least one API permission to the app registration, then grant admin consent.
Steps:
User.Read (many custom apps created via script/Graph API/Terraform skip this default permission that apps created through the portal wizard get automatically)The CA "Cloud apps" picker appears to require a service principal to have some minimal depth to its registration — at least one configured API permission — to be treated as a complete/selectable resource. Apps provisioned with zero permissions (no delegated or application permissions at all, not even the default Graph User.Read) can end up with a service principal object that exists but isn't fully "surfaced" for CA targeting. Adding a permission and granting consent appears to trigger the update that completes this.
This is not officially documented behavior by Microsoft as of mid-2026 — it's an empirically observed fix.
HideApp or similar tag presentApplication, not ManagedIdentity/LegacyAdd at least one API permission to the app registration, then grant admin consent.
Steps:
User.Read (many custom apps created via script/Graph API/Terraform skip this default permission that apps created through the portal wizard get automatically)The CA "Cloud apps" picker appears to require a service principal to have some minimal depth to its registration — at least one configured API permission — to be treated as a complete/selectable resource. Apps provisioned with zero permissions (no delegated or application permissions at all, not even the default Graph User.Read) can end up with a service principal object that exists but isn't fully "surfaced" for CA targeting. Adding a permission and granting consent appears to trigger the update that completes this.
This is not officially documented behavior by Microsoft as of mid-2026 — it's an empirically observed fix. If you hit this, it's worth filing a support ticket with Microsoft so it gets tracked, since the underlying cause isn't confirmed.