{"id":12717,"date":"2025-09-05T05:01:00","date_gmt":"2025-09-04T20:01:00","guid":{"rendered":"https:\/\/m365jp.net\/?p=12717"},"modified":"2025-09-05T05:02:04","modified_gmt":"2025-09-04T20:02:04","slug":"mc1123830-updated-microsoft-entra-action-required-c-update-conditional-access-policies-for-azure-devops-sign-ins","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2025-09-05-mc1123830-updated-microsoft-entra-action-required-c-update-conditional-access-policies-for-azure-devops-sign-ins","title":{"rendered":"MC1123830 | (Updated) Microsoft Entra: Action Required C Update Conditional Access Policies for Azure DevOps Sign-ins"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC1123830 | (Updated) Microsoft Entra: Action Required C Update Conditional Access Policies for Azure DevOps Sign-ins<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n\n\n
Classification<\/th>\nplanForChange<\/td>\n<\/tr>\n
Last Updated<\/th>\n09\/04\/2025 19:48:11<\/td>\n<\/tr>\n
Start Time<\/th>\n07\/28\/2025 23:49:43<\/td>\n<\/tr>\n
End Time<\/th>\n10\/27\/2025 07:00:00<\/td>\n<\/tr>\n
Action Required By Date<\/th>\n2025-09-04T07:00:00Z<\/td>\n<\/tr>\n
Message Content<\/th>\n\n

Updated September 4, 2025: We have updated the timeline. Thank you for your patience.<\/p>\n

Introduction<\/b><\/p>\n

Microsoft Entra is updating how Conditional Access (CA) policies apply to Azure DevOps sign-ins. Azure DevOps will no longer rely on the Azure Resource Manager (ARM) resource during sign-in or token refresh flows. This change ensures that access controls are applied directly to Azure DevOps. Organizations must update their Conditional Access policies to explicitly include Azure DevOps to maintain secure access.<\/p>\n

When this will happen
<\/b><\/p>\n

This change will take effect starting September 2, 2025<\/b>, and will be fully enforced by September 18, 2025 <\/b>(previously September 4), across all environments.<\/p>\n

How does this affect your organization?<\/b><\/p>\n

If your organization has Conditional Access policies targeting the Windows Azure Service Management API (App ID: 797f4846-ba00-4fd7-ba43-dac1f8f63013), those policies will no longer apply to Azure DevOps sign-ins. This may result in unprotected access<\/b> unless these policies are updated to include Azure DevOps (App ID: 499b84ac-1321-427f-aa17-267ca6975798). <\/p>\n

    \n
  • Access controls such as MFA or compliant device requirements may not be enforced unless policies are updated. <\/li>\n
  • If you already have a policy that targets all users and all cloud apps and does not explicitly exclude Azure DevOps, no action is required\u2015Azure DevOps sign-ins will continue to be protected. <\/li>\n
  • This change does not introduce any new user-facing experience or UI changes. <\/li>\n
  • Sign-in activity can be monitored using Microsoft Entra ID sign-in logs.<\/li>\n
  • Licensing requirement: Microsoft Entra ID P1 or P2 is required. There are no functional differences by license type. This is a feature change, not a new feature, so trial or preview options are not applicable.<\/li>\n
  • Unlicensed users may also be impacted. <\/li>\n
  • Existing Conditional Access policies will be affected, specifically those targeting the Windows Azure Service Management API. <\/li>\n
  • A small subset of tenants may see the app name as “Microsoft Visual Studio Team Services” instead of “Azure DevOps”\u2015the App ID remains the same.<\/li>\n<\/ul>\n

     What do you need to do to prepare?<\/b><\/p>\n

    To ensure continued protection of Azure DevOps sign-ins, administrators should: <\/p>\n

Machine Translation<\/th>\n\n

2025 \u5e74 9 \u6708 4 \u65e5\u66f4\u65b0: \u30bf\u30a4\u30e0\u30e9\u30a4\u30f3\u3092\u66f4\u65b0\u3057\u307e\u3057\u305f\u3002\u304a\u5f85\u3061\u3044\u305f\u3060\u304d\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3059\u3002<\/p>\n

B\u4ecb<\/b><\/p>\n

Microsoft Entra \u3067\u306f\u3001\u6761\u4ef6\u4ed8\u304d\u30a2\u30af\u30bb\u30b9 (CA) \u30dd\u30ea\u30b7`\u304c Azure DevOps \u30b5\u30a4\u30f3\u30a4\u30f3\u306bm\u7528\u3055\u308c\u308b\u65b9\u6cd5\u3092\u66f4\u65b0\u3057\u3066\u3044\u307e\u3059\u3002Azure DevOps \u306f\u3001\u30b5\u30a4\u30f3\u30a4\u30f3\u307e\u305f\u306f\u30c8`\u30af\u30f3\u66f4\u65b0\u30d5\u30ed`\u4e2d\u306b Azure Resource Manager (ARM) \u30ea\u30bd`\u30b9\u306b\u4f9d\u5b58\u3057\u306a\u304f\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u6d93\u6454\u745c\u8f8d\u4e92\u602a\u6734 Azure DevOps \u306b\u76f4\u63a5m\u7528\u3055\u308c\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002M\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3067\u4fddo\u3055\u308c\u305f\u30a2\u30af\u30bb\u30b9\u3092S\u6301\u3059\u308b\u305f\u3081\u306b\u3001Azure DevOps \u3092\u660e\u793a\u7684\u306b\u542b\u3081\u308b\u3088\u3046\u306b\u6761\u4ef6\u4ed8\u304d\u30a2\u30af\u30bb\u30b9 \u30dd\u30ea\u30b7`\u3092\u66f4\u65b0\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n

\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b<\/b><\/p>\n

\u3053\u306e\u6d93 2025 \u5e74 9 \u6708 2<\/b> \u65e5\u304b\u3089\u6709\u90e1\u6454\u80dc\u8f8d 2025 \u5e74 9 \u6708 18 \u65e5 <\/b>(\u4ee5\u524d\u306f 9 \u6708 4 \u65e5) \u307e\u3067\u306b\u3059\u3079\u3066\u306eh\u5883\u3067\u5b8c\u5168\u306bm\u7528\u3055\u308c\u307e\u3059\u3002<\/p>\n

\u3053\u308c\u306fM\u306b\u3069\u306e\u3088\u3046\u306a\u5f71\u3092\u4e0e\u3048\u307e\u3059\u304b?<\/b><\/p>\n

M\u306b Windows Azure Service Management API (\u30a2\u30d7\u30ea ID: 797f4846-ba00-4fd7-ba43-dac1f8f63013) \u3092\u8c61\u3068\u3059\u308b\u6761\u4ef6\u4ed8\u304d\u30a2\u30af\u30bb\u30b9 \u30dd\u30ea\u30b7`\u304c\u3042\u308b\u9f8a\u7a00\u957f\u6b37\u6901\u8fdd\u836a\u8f9a\u73d0`\u306f Azure DevOps \u30b5\u30a4\u30f3\u30a4\u30f3\u306bm\u7528\u3055\u308c\u306a\u304f\u306a\u308a\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u3053\u308c\u3089\u306e\u30dd\u30ea\u30b7`\u304c Azure DevOps (\u30a2\u30d7\u30ea ID: 499b84ac-1321-427f-aa17-267ca6975798) \u3092\u542b\u3080\u3088\u3046\u306b\u66f4\u65b0\u3055\u308c\u306a\u3044\u9650\u308a\u3001 \u4fddo\u3055\u308c\u3066\u3044\u306a\u3044\u30a2\u30af\u30bb\u30b9<\/b> \u304ck\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n