We need to create conditional access by device for a user

Achilles G 0 Reputation points
2026-10-05T16:12:38.8933333+00:00

Several users are getting prompted in Microsoft Authenticator even though they are NOT trying to sign in

Can we create a policy that limits sign in to only their devices?

Microsoft Security | Microsoft Authenticator
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Marcin Policht 109.8K Reputation points MVP Volunteer Moderator
    2026-10-05T16:20:57.64+00:00

    You could - as long as the number of users is small (this is not scalable)...

    Build a rule that says: “If a sign-in comes from this specific user, block it unless the Device ID matches their actual hardware.”

    Navigate to the Microsoft Entra Admin Center and go to Protection > Conditional Access > Policies > New Policy.

    Under Users, select the specific targeted users. Under Target Resources, select All Cloud Apps.

    Under Conditions > Filter for devices, set Configure to Yes and select Exclude filtered devices from policy. Create a rule using device.deviceId In ['device-id-1', 'device-id-2']. You can obtain the exact hardware Device IDs from the Devices section in Microsoft Entra ID.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.