I have an old conditional access policy affecting network access to My Sign-ins that can't be deleted or modified

McTest Learnname 0 Reputation points
2026-06-09T16:45:45.73+00:00
  • Issue: Conditional Access policy edit returns error 1189
  • Policy name: Security info registration for Microsoft partners and vendors
  • Policy ID: 701d7697-b38a-46be-9a2c-c999ed2a2c1b
  • Template ID: 4200930c-0da2-4e33-ca01-200000000002
  • Error: “The server could not process the request because it is malformed or incorrect. 1189: You cannot change the properties of this policy. Reach out to your Microsoft contact for further help.”
  • Impact: Unable to modify the policy at all, including exclusions and the policy name
Microsoft Security | Microsoft Entra | Other

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-06-09T16:45:58.68+00:00

    Error 1189 indicates that the Conditional Access policy is not editable and must be handled by Microsoft. The message “You cannot change the properties of this policy. Reach out to your Microsoft contact for further help.” means the policy is effectively locked from tenant-side modification, including name changes, exclusions, or other property edits.

    The only supported remediation path in this situation is to engage Microsoft support so they can review and, if appropriate, update or remove the policy on the backend:

    1. If there are any other admins in the tenant who still have access to Conditional Access and are not blocked by this policy, have one of them confirm that the policy cannot be edited or disabled from the Microsoft Entra admin center under Entra ID > Conditional Access.
    2. If no admin can modify or disable the policy, open a support request with Microsoft:
      • Follow the guidance in How to get support to submit a support request.
      • Provide the policy name, policy ID, template ID, the full error text including code 1189, and recent sign-in details (Request ID, time, and date from affected sign-in events) so support can locate the exact policy and its impact.
    3. While working with support, use the sign-in logs and Conditional Access details to document the impact:
      • In Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs.
      • Open a failed sign-in, review Basic info and Conditional Access tabs to confirm this specific policy is being applied and blocking access.
      • Include these details (especially Request ID and timestamp) in the support case to speed investigation.

    Because the platform is explicitly blocking tenant-side edits to this policy, only Microsoft support can change or remove it.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.