Windows Azure Service Management API not available when configuring Conditional Access policy

Hello @Konstantinos Lianos

Thank you for the clarification.

We have already implemented and enabled the Conditional Access policy with Azure Resource Manager selected as the target resource.

We have also tested the policy with a non-privileged user, and the user was successfully denied access to the Azure portal, confirming that the Conditional Access policy is being enforced as expected.

However, the security recommendation "Ensure 'Microsoft Azure Management' is limited to administrative roles" still remains incomplete, and the Secure Score has not updated.

Could you please advise whether Azure Resource Manager alone is sufficient to satisfy this recommendation, or whether any additional target resources are required for the recommendation to be detected as completed?

Hello @Ven Phearun
Yes. If the Azure Resource Manager target you selected has Application ID 797f4846-ba00-4fd7-ba43-dac1f8f63013, it is the same underlying resource that Microsoft documentation refers to as Windows Azure Service Management API / Microsoft Azure Management. No additional target resource should be required. Microsoft Learn

Since your test confirms that non-privileged users are being blocked, the policy appears to be working as intended.

The remaining Secure Score status is most likely an evaluation delay. Microsoft states that completed actions can take 24 to 48 hours to appear in Secure Score. Microsoft Learn

I would wait 24 to 48 hours. If the recommendation still remains incomplete after that, I would raise a Microsoft Support case, as the Secure Score evaluator may not be detecting the updated resource display name correctly.

If this answer helps, please mark it as Accepted/Resolved so it can help others as well.

Hello @Konstantinos Lianos ,

Yes, thanks for sharing and information. But the way, the policy has been created for a long time, but the score does not update. I think may be not because of duration.

Hello @Ven Phearun

Thank you for confirming. If the policy has already been enabled for a long time, then I agree that this is unlikely to be only a Secure Score evaluation delay.

I also want to clarify one point from my previous reply.

According to the current Microsoft Conditional Access documentation, Windows Azure Service Management API is still a supported target resource and is treated as a grouping/suite of Azure management services. Microsoft states that this grouping includes:

Azure Resource Manager

Azure portal, including the Microsoft Entra admin center

Azure Data Lake

Application Insights API

Log Analytics API

Therefore, Azure Resource Manager by itself should not be considered an exact replacement for the Windows Azure Service Management API grouping.

Your test with the non-privileged account confirms that the Conditional Access policy targeting Azure Resource Manager is working for that particular Azure portal/ARM access path. However, it does not necessarily mean that the Secure Score recommendation considers the complete requirement satisfied.

This is particularly relevant because Microsoft Secure Score specifically introduced an improvement action named "Ensure 'Windows Azure Service Management API' is limited to administrative roles."

I would therefore recommend checking whether Windows Azure Service Management API can be made available as the target resource rather than using Azure Resource Manager alone.

Microsoft also documents that some applications might not appear in the Conditional Access picker if the corresponding service principal is not present in the tenant. In such cases, the missing service principal can be added using Microsoft Graph / New-MgServicePrincipal.

The application ID documented by Microsoft for Windows Azure Service Management API is:

797f4846-ba00-4fd7-ba43-dac1f8f63013

So I would first verify the service principal in the tenant and then configure the Conditional Access policy against Windows Azure Service Management API itself.

Also verify that the policy matches the recommendation configuration exactly, especially the user scope, administrative-role exclusions, Block access grant control, target resource, and that the policy is enabled.

Microsoft states that Secure Score changes normally take approximately 24–48 hours to be reflected. Since your policy has existed significantly longer than that, if the policy is changed to target Windows Azure Service Management API and the recommendation still does not update after the next evaluation cycles, I would open a Microsoft Support case because at that point it may be a Secure Score detection issue rather than a Conditional Access enforcement issue.

Hope this helps clarify the distinction.