How to exclude users from a Conditional Access Policy

These steps show how to exclude users from a Conditional Access policy.

Go to https://portal.azure.com and sign in with your admin credentials.

Navigate to Microsoft Entra ID.

On the left menu, select Protection

Click on Conditional Access.

Head over to Policies in the left menu

Click Policies, then select the policy you want to modify (e.g., Require MFA for access from untrusted networks).

Under Assignments, click Users or workload identities.

Go to the Exclude tab and click Select excluded users.

Search for the user or group you want to exclude, select them, and click Select.

Click Save to apply the changes.

Remove a User from the Exclusion List

If you want to reverse the action or remove a user from the exception.

Open the same Conditional Access policy.

Under Users or workload identities > Exclude, click Select excluded users.

Locate the user or group, click the three dots next to their name, and choose Remove.

Click on the three dots next to the user and click on Remove

The user will now be removed from the exception to the CA policy.

Click Save to finalize the update.

If you have any further questions, please contact us at support@bemopro.com