Windows Azure Service Management API not available when configuring Conditional Access policy

Question

Windows Azure Service Management API not available when configuring Conditional Access policy

Ven Phearun 0

Hello,

We are implementing the security recommendation "Ensure 'Microsoft Azure Management' is limited to administrative roles."

As part of the implementation, we created a Conditional Access policy and attempted to select the required target resource. However, when searching the available resources, "Windows Azure Service Management API" does not appear as an option.

We can see "Azure Resource Manager" as an available target resource.

Could you please clarify:

Has Windows Azure Service Management API been renamed, replaced, or deprecated as a selectable target resource in Conditional Access?
For this security recommendation, is selecting Azure Resource Manager sufficient to meet the intended requirement?

Thank you.

0 comments

1 answer

Your answer

Answer 1

Konstantinos Lianos 830 Student Ambassador

Hello @Ven Phearun

Windows Azure Service Management API has not been officially deprecated. Microsoft documentation still references it as the target for Azure management Conditional Access policies. However, it may no longer appear in the app picker for some tenants, where Azure Resource Manager can be used instead.

One important point is that Windows Azure Service Management API is a broader grouping that includes Azure Resource Manager, Azure portal, Log Analytics API, Application Insights API, and others. Therefore, Azure Resource Manager is not an exact 1:1 replacement, although it covers the primary ARM-based management access.

For this recommendation, if the original resource is not available, I would use Azure Resource Manager, initially in Report-only mode, and validate the affected sign-ins before enforcement.

If this answer helps, please mark it as Accepted/Resolved so it can help others as well.

Ven Phearun 0 Reputation points

2026-10-06T10:23:19.49+00:00

Hello @Konstantinos Lianos

Thank you for the clarification.

We have already implemented and enabled the Conditional Access policy with Azure Resource Manager selected as the target resource.

We have also tested the policy with a non-privileged user, and the user was successfully denied access to the Azure portal, confirming that the Conditional Access policy is being enforced as expected.

However, the security recommendation "Ensure 'Microsoft Azure Management' is limited to administrative roles" still remains incomplete, and the Secure Score has not updated.

Could you please advise whether Azure Resource Manager alone is sufficient to satisfy this recommendation, or whether any additional target resources are required for the recommendation to be detected as completed?
Konstantinos Lianos 830 Reputation points Student Ambassador

2026-10-06T10:36:42.5966667+00:00

Hello @Ven Phearun
Yes. If the Azure Resource Manager target you selected has Application ID 797f4846-ba00-4fd7-ba43-dac1f8f63013, it is the same underlying resource that Microsoft documentation refers to as Windows Azure Service Management API / Microsoft Azure Management. No additional target resource should be required. Microsoft Learn

Since your test confirms that non-privileged users are being blocked, the policy appears to be working as intended.

The remaining Secure Score status is most likely an evaluation delay. Microsoft states that completed actions can take 24 to 48 hours to appear in Secure Score. Microsoft Learn

I would wait 24 to 48 hours. If the recommendation still remains incomplete after that, I would raise a Microsoft Support case, as the Secure Score evaluator may not be detecting the updated resource display name correctly.

If this answer helps, please mark it as Accepted/Resolved so it can help others as well.