Entra Enterprise app unable to include/exclude public clients

Question

Entra Enterprise app unable to include/exclude public clients

Eunice 41

I have a enterprise app that is a public client (for mobile app). there doesn't seem to be a way to exclude or include the app in the conditional access policies. So can i check if we want to enforce MFA for the enterprise app, or exclude the app from requiring app protection, how can we do so?

Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-05-04T02:10:54.1266667+00:00

Hello Eunice

Based on this Microsoft document, this is by design, Conditional Access policies are applied to resource services (APIs) and not to client (public/native) applications.

Your mobile app does not represent a resource; rather, it only initiates authentication because it is a public client. As a result, it cannot be easily added to or removed from Conditional Access restrictions and does not show up in the app picker.

Instead of at the client level, policies are assessed when the client app uses a target service (like Microsoft Graph or a custom API). The policy must be applied to the target resource, users/groups, or, if app-specific control is needed, by leveraging authentication context in order to enforce MFA or regulate access.

Let me know if any further queries - feel free to reach out!
Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-05-05T10:23:40.1933333+00:00

Hello Eunice

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer accepted by question author

0 additional answers

Your answer

Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-05-04T02:10:54.1266667+00:00

Hello Eunice

Based on this Microsoft document, this is by design, Conditional Access policies are applied to resource services (APIs) and not to client (public/native) applications.

Your mobile app does not represent a resource; rather, it only initiates authentication because it is a public client. As a result, it cannot be easily added to or removed from Conditional Access restrictions and does not show up in the app picker.

Instead of at the client level, policies are assessed when the client app uses a target service (like Microsoft Graph or a custom API). The policy must be applied to the target resource, users/groups, or, if app-specific control is needed, by leveraging authentication context in order to enforce MFA or regulate access.

Let me know if any further queries - feel free to reach out!
Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-05-05T10:23:40.1933333+00:00

Hello Eunice

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

hi Gents, so Eunice hi, as correct said Rukmini yeah this is expected.

Conditional Access targets the resource/API being accessed, not really the public client/mobile app itself. A public client often wont show as something u can include/exclude in “Cloud apps”, because it is the app requesting the token, not the protected resource. To enforce MFA, create a CA policy targeting the backend/API enterprise app or “All cloud apps”, then scope users/groups and client app = mobile apps and desktop clients. To exclude it from app protection requirement, exclude the resource app/API that receives the token, not the mobile client. If this is a custom mobile app, make sure the backend API has an enterprise application/service principal in the tenant, then target that. For Intune app protection, the app itself must support MAM/APP; if it doesnt, CA “Require app protection policy” will block it and u cant fix that with Azure AI style permissions. Other words client is not the thing CA protects, target the API/resource behind it

rgds, Alex

&

if my answer helps pls accept it.

Share via

Entra Enterprise app unable to include/exclude public clients

0 additional answers

Your answer