AADSTS53003 blocks service principal client_credentials for Microsoft Graph — sign-in log shows "Not applicable" for Conditional Access

Our backend service cannot obtain a Microsoft Graph token via client_credentials. The token request is rejected with AADSTS53003 — Access has been blocked by  

  Conditional Access policies. The corresponding service principal sign-in log shows the Conditional Access result as "Not applicable" with an empty

  applied-policies list. We can't see, identify, or modify the policy that is blocking us.                                                                       

  The token endpoint response includes a claims requirement referencing a Conditional Access policy ID that does not exist in our tenant when queried via        

  Microsoft Graph (/identity/conditionalAccess/policies returns 0 rows; the specific policy ID returns ResourceNotFound).

  Environment                                                        

  - Microsoft 365 Business Standard + Microsoft Entra ID P2 trial active                                                                                         

  - App registration: multi-tenant, with client secret

  - Service principal: enabled in tenant                                                                                                                         

  - Application permission: OnlineMeetings.ReadWrite.All — admin consent granted                                                                                 

  - Caller location: a single public IPv4 (added to a Trusted Named Location)

  - Security Defaults: currently Enabled                                                                                                                         

  What works                                                                                                                                                     

  - Delegated (user) Graph calls work normally for the same app                                                                                                  

  - Service principal is visible and enabled in Enterprise Applications

  - All admin consents are confirmed                                                                                                                             

  What fails                                                                                                                                                     

  - Every POST /oauth2/v2.0/token with grant_type=client_credentials returns HTTP 400 / AADSTS53003                                                              

  - Failure reproduces consistently from the same IP                 

  Roles I currently hold                                                                                                                                         

  - Conditional Access Administrator                                                                                                                             

  - Application Administrator                                        

  - Cloud Application Administrator

  - Application Developer

  I do not hold Global Administrator or Security Administrator.                                                                                                  

  Diagnostics already performed                                                                                                                                  

  - Confirmed zero tenant Conditional Access policies (v1.0 and beta endpoints)                                                                                  

  - Confirmed the specific policy ID in the capolids claim does not exist in the directory

  - Verified service principal sign-in log shows conditionalAccessStatus: notApplied and appliedConditionalAccessPolicies: [] while still failing with code 53003

  - Created and "trusted" a Named Location containing the caller IP (currently not referenced by any CA policy)                                                                                                                                                                                                

  Questions                                                                                                                                         

  1. When a tenant has zero Conditional Access policies AND the sign-in log reports "Not applicable", yet AADSTS53003 fires with a capolids claim referencing a  

  policy ID that doesn't exist in the directory — is this a Microsoft-managed workload identity protection that is invisible without Workload Identities Premium?

  2. Is Microsoft Entra Workload Identities Premium the only supported license to create an explicit override (allow CA policy) for this enforcement?            

  3. Does disabling Security Defaults remove this enforcement, or is it an independent layer?                                                                    

  4. For tenants without Workload Identities Premium, what is the supported configuration path so a legitimate service principal can obtain a client_credentials 

  Microsoft Graph token?                                                                                                                                         

  Goal                                                                                                                                                           

  We are building a SaaS Microsoft Teams integration that needs to create Microsoft Graph subscriptions on Teams meetingCallEvents. The documentation states this

   subscription requires app-only auth with OnlineMeetings.Read.All (which we have, admin-consented). We need to understand what tenant configuration is required

   so this works — both in our test tenant and in customer tenants that install our app.