📋 Microsoft Entra Documentation Changes

1. Under **Assignments**, select **Users or workload identities**.

1. Under **Include**, select the users you want in scope for the policy (**All users** recommended).

1. Under **Exclude**:

1. Under **Target resources** > **Resources (formerly cloud apps)**:

1. Under **Include**, select **All resources (formerly 'All cloud apps')** unless your organization validated a narrower resource scope for the scenario.

1. Under **Exclude**, select **Select excluded cloud apps** and add **Device Registration Service**. This exclusion is required so device registration through device code flow isn't blocked by your policy. For more information, see [Enforcement of Authentication Flows policies on Device Registration Service resource](concept-authentication-flows.md#enforcement-of-authentication-flows-policies-on-device-registration-service-resource).

1. Select **Device code flow**.

1. Select **Done**.

1. Under **Access controls** > **Grant**, select **Block access**.

1. Confirm your settings and set **Enable policy** to **Report-only**.

1. Select **Create** to enable your policy.

 

ms.service: entra-id

ms.subservice: conditional-access

ms.topic: concept-article

ms.reviewer: swethar

ms.custom: sfi-image-nochange

---

 

Device code flow is rarely used by customers, but is frequently used by attackers. Enabling this Microsoft-managed policy for your organization helps remove this attack vector.

 

### Multifactor authentication for admins accessing Microsoft Admin portals

 

This policy covers [14 admin roles](#what-administrator-roles-are-covered-by-these-policies) that are highly privileged, who access the [Microsoft Admin Portals](policy-old-require-mfa-admin-portals.md), and requires them to perform multifactor authentication.

| Feature | Workforce tenant | External tenant |

| ------- | ---------------- | --------------- |

| Identity providers for external users (primary authentication) | For self-service sign-up guests:<ul><li>Microsoft Entra accounts</li><li>Microsoft accounts</li><li>Emailed one-time passcode</li><li>Google federation</li><li>Facebook federation</li></ul></br>For invited guests:<ul><li>Microsoft Entra accounts</li><li>Microsoft accounts</li><li>Emailed one-time passcode</li><li>Google federation</li><li>SAML/WS-Fed federation</li></ul> | For self-service sign-up users (consumers, business customers):<ul><li>[Authentication methods available in External ID](#authentication-methods-available-in-external-id)</li></ul></br>For invited guests (preview) via a directory role (for example, admins):<ul><li>Microsoft Entra accounts</li><li>Microsoft accounts</li><li>[Emailed one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)</li><li>[SAML/WS-Fed federation](../direct-federation.md)</li></ul></br> You can invite external users for administrative purposes only. You can't use this feature to invite customers to sign in to your apps. This feature isn't compatible with customer identity and access management (CIAM) user flows. |

 

### Authentication methods available in External ID

 

- Contractors are governed by their own policies separate from the baseline

 

If your Conditional Access strategy applies certain policies to full-time employees, describe how full-time employees are defined. For example, are these employees defined with specific user attributes or group membership?

 

### Policy naming conventions