How to exclude MS Authenticator from a Block CAP on personal devices?

To exclude the Microsoft Authenticator app from a Conditional Access Policy (CAP) that blocks all resources on personal devices, you can create an exclusion specifically for the Authenticator app. Here are the general steps to do this:

1. Access the Microsoft Entra admin center: Sign in as a Conditional Access Administrator.
2. Navigate to Conditional Access Policies: Go to Entra ID > Conditional Access > Policies.
3. Edit your existing policy: Find the policy that blocks access on personal devices and select it for editing.
4. Add an exclusion: Under the Assignments section, look for the Cloud apps or actions option. Here, you can specify the Microsoft Authenticator app to be excluded from the policy.
5. Save your changes: After making the necessary adjustments, ensure you save the policy.

By following these steps, you should be able to allow access to the Microsoft Authenticator app while still enforcing restrictions on other resources on personal devices.

References:

• Block unknown or unsupported device platform
• Require device compliance with Conditional Access