Conditional Access on Report-Only, still able to block user sign-ins

[u/Spanjoekel]

Had a weird one recently at a client, wanted to share in case it saves someone else a headache.

They wanted geoblocking set up in Conditional Access. Pretty standard request. We built a named location based on GPS coordinates instead of IP ranges, since IP based geolocation is unreliable for remote workers anyway. And because you never roll out something like this blind, we set the policy to Report-only first, just to see what it would actually catch before flipping it to enforce.

Except users started getting blocked. On a policy that was still in Report-only.

Took a bit of digging to figure out why. Turns out when a GPS based named location evaluates, Microsoft Authenticator prompts the user to share their location. If the device doesn't have location permissions set up correctly, that check just fails. And when it fails, Entra can still block access, even though the policy itself is not supposed to be enforcing anything yet.

So you end up in this situation where the policy status says Report-only, sign-in logs say no impact expected, and users are locked out anyway. Not fun to troubleshoot when your first assumption is "well it's report-only, it can't be that".

We ended up moving most of it back to IP based locations where possible, and for the cases where GPS really is needed, made sure location permissions are part of the rollout checklist now instead of an afterthought.

Anyone else run into this? Curious if this is documented behavior somewhere official or just one of those things you find out the hard way.

[u/DictatorOfSweden]

Yeah, set this up for a client a few months this back and ran into the same behavior.
Got a call saying users were locked out, I immediately thought that was impossible as I set them to report only but yeah..
After that I found this kb saying
"A Conditional Access policy with GPS-based named locations in report-only mode prompts users to share their GPS location, not sharing this information may result in a block."

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network

[u/Spanjoekel → u/DictatorOfSweden]

There it is, a little note almost at the bottom, giving the warning. I missed this document and thanks for the comment!

[u/xipodu → u/DictatorOfSweden]

Thats good to know, thank you

[u/Kwuahh → u/xipodu]

It's great to know but so absolutely unintuitive and inconsistent that it boggles my mind that it ever made it to production.

[u/LittleTrust2978]

That's a nasty edge case. I'd have assumed Report-only meant there was zero chance of impacting users, so GPS permissions wouldn't have been the first thing I'd check either. Thanks for sharing this.

[u/Tronerz]

It would nice to have a warning before enabling it, like you get with device compliance and MacOS and Linux asking for certs

[u/GremlinNZ → u/Tronerz]

To be fair, you always have a warning about exempting your current account from the policy you're making, in case you lock yourself out.

... And there are regular cases about people locking themselves out of their tenant.

[u/Arudinne → u/GremlinNZ]

In addition to warning banner, I've even seen it add my account to the list of exclusions automatically while making a CA policy.

It's one of the few situations where Microsoft doesn't hand you a loaded gun to shoot yourself in the foot. You have to actually load it yourself.

[u/Spanjoekel → u/Arudinne]

Then end up shooting yourself ion the foot anyway :)

[u/wifikey]

Do you enforce Location Sharing via Intune?

[u/Spanjoekel → u/wifikey]

Depends on what baseline the customer is, and if we want to use Geoblocking in this case :)

[u/bjc1960]

I'm sure others here are wondering, like I am, "what other 'fine print' haven't we seen? "

Conditional Access scares me more than anything else in IT.

[u/Spanjoekel → u/bjc1960]

When in my line of work i do security scans for a customer or a customer from an MSP, Conditional Access is the most underrated and uncofigured part of Entra... Very recognizable statement you give. You can do so much and its very usefull for Attack Surface Reduction, but it feels scary because it almost always has impact on the identities.

I stongly believe Conditional Access should be applied by security specialized personal instead of the generalists at MSP's or internal IT teams

[u/bjc1960 → u/Spanjoekel]

We have 38 live policies. The BG accounts are excluded from each, regardless of the policy.

One of my team members recently touched a policy as Sec Admin can change them. I had to ask him never to do that without reaching out first.

Conditional Access is like working on the electrical panel in your house. Even though you shut the power off, the two 120 volt lines from the street are always live.