Customer Advisory: Potential Microsoft Entra ID Token Issues for Non-Entra Joined Devices

Article summary

Microsoft recently introduced a change to Conditional Access enforcement for policies that target 'All Resources' and contain application exclusions. With this change, authentication requests that previously bypassed Conditional Access evaluation may now be evaluated against MFA, device-compliance, or other access controls, even when an application exclusion exists. As a result, Workspot users who access the platform from devices that are not Microsoft Entra ID joined, Hybrid Microsoft Entra ID joined, or compliant may experience token-related authentication issues when Conditional Access policies enforce device-based requirements. This behavior aligns with Microsoft’s documented Conditional Access enforcement changes.

Reference: Microsoft Learn – Enforcement for baseline scopes in Conditional Access: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-enforcement-resource-exclusions#enable-enforcement-recommended

Potential Symptoms

• Workspot Client activation failures

• Invalid or Expired Microsoft Entra ID Token errors

• Repeated authentication prompts

• Desktop or application launch failures

• Token validation errors during authentication

• Workspot Client Control Error 712 or similar authentication-related failures

Possible Cause

Conditional Access policies that require compliant devices, Microsoft Entra ID joined devices, Hybrid Microsoft Entra ID joined devices, MFA, or other grant controls may now be evaluated for authentication flows that were previously excluded or not enforced. Policies targeting 'All Resources' with application exclusions may therefore enforce these controls for authentication requests involving baseline scopes, such as openid, profile, and User.Read. Users connecting from unmanaged, non-compliant, or non-Entra-joined devices may encounter new authentication challenges or token issuance failures.

Microsoft Entra ID Conditional Access Enforcement Change

Microsoft has introduced an enhanced Conditional Access enforcement model for policies that target 'All Resources' and include one or more resource exclusions.

Historically, when a Conditional Access policy targeted 'All Resources' and excluded a specific application, authentication requests involving only baseline scopes (such as OpenID Connect scopes and certain Microsoft Graph directory scopes) could bypass Conditional Access evaluation. As a result, users could successfully obtain Microsoft Entra ID tokens without satisfying controls such as:

• Multi-factor authentication (MFA)

• Device compliance requirements

• Microsoft Entra ID joined device requirements

• Hybrid Entra ID joined device requirements

Baseline scopes include:

• OIDC scopes: email, offline_access, openid, profile

• Baseline directory scopes: User.Read, User.Read.All, User.ReadBasic.All, People.Read, People.Read.All, GroupMember.Read.All, Member.Read.Hidden

With Microsoft’s updated enforcement model, baseline scopes are evaluated as directory access and may be subject to Conditional Access policies even when an application exclusion exists. This can affect token issuance for authentication requests that include baseline scopes and do not satisfy the policy’s grant controls.

1. Applications excluded from ‘All Resources' Conditional Access policy may still trigger Conditional Access evaluation for baseline scope requests.

2. Users accessing Workspot from unmanaged, non-compliant, or non-Entra-joined devices may be required to satisfy additional Conditional Access controls before Microsoft Entra ID issues a token.

3. Authentication workflows that previously succeeded without MFA or device validation may now encounter Conditional Access challenges.

4. If token issuance is blocked or additional requirements cannot be met, Workspot authentication may fail, resulting in activation, sign-in, or desktop launch issues.

Recommendations for Workspot Customers

• Review all Conditional Access policies targeting 'All Resources'.

• Verify whether the Workspot Enterprise Application or related applications are explicitly excluded from those policies.

• Consider testing policy changes in Report-only mode before enabling enforcement.

• Review Microsoft Entra Sign-in Logs → Conditional Access to determine whether Workspot authentication requests are being evaluated by the policy.

• Validate user workflows after any Conditional Access change, including Workspot Client activation, Workspot Client reset/re-activation, desktop launch, application launch, and browser-based authentication.

Temporary Mitigation: Disable Baseline Scope Enforcement

Microsoft recommends enabling enforcement for baseline scopes. In the Microsoft Entra admin center, this appears under Conditional Access > Baseline scope settings (Preview), where "Enable enforcement" is marked as Recommended. Customers should review this Microsoft guidance before deciding whether to temporarily disable enforcement for troubleshooting or operational continuity.

Figure 1: Microsoft Entra ID Baseline Scope Settings (Preview) – Enable Enforcement Recommended Option

Microsoft identifies disabling enforcement as 'Not recommended' because it may create gaps in Conditional Access enforcement for baseline scopes. Use “Disable Enforcement” option only as temporary mitigation after evaluating the security implications and confirming that the change is required to restore impacted authentication flows. Workspot Engineering is actively evaluating the impact of Microsoft's baseline enforcement changes and developing guidance to adopt the updated enforcement model without disruption.

Figure 2: Microsoft Entra ID Baseline Scope Settings (Preview) – Disable Enforcement

Steps to Temporarily Disable Baseline Scope Enforcement

1. Sign in to the Microsoft Entra admin center.

2. Navigate to Protection > Conditional Access.

3. Select Baseline scope settings (Preview).

4. Under 'Choose how baseline scope sign-ins should be handled', select Disable enforcement.

5. Click Save.

Expected Result

After saving the configuration, Microsoft Entra ID reverts to the legacy Conditional Access evaluation behavior for baseline scope requests. This may help restore authentication flows that are impacted by the new enforcement model.

Validation Steps

1. Launch the Workspot Client.

2. Perform a new sign-in.

3. Verify successful client activation.

4. Verify desktop and application launch functionality.

5. Review Microsoft Entra Sign-in Logs for Conditional Access evaluation results.

Note

Workspot authentication relies on Microsoft Entra ID token issuance. Conditional Access policies that enforce device compliance, device join requirements, or other access controls may affect client activation and access to Workspot resources if the authentication token cannot be successfully issued or validated.