A policy can only govern an object the policy engine can resolve. An application appearing in your sign-in logs, does not guarantee that a corresponding service principal exists in your tenant! Why?

That single assumption is where things quietly break.

Microsoft have hundreds of first-party apps in a global directory, but they not all lives in your tenant by default. A service principal is only created on first consent - or when an admin registers it manually, so many background services, infrastructure apps and newer products (Global Secure Access/ZTNA clients, Defender for Mobile, Intune Tunnel, Windows Sign In, AVD and Windows 365…) never trigger that flow for some.

The result: apps your users authenticate against every day, showing up in your sign-in logs - with no service principal to exclude in etc. Conditional Access there use restictions or App Protection policies (my sample in the blog post), simply have nothing to bind to, so the app silently falls outside your controls. "All Apps" policy has more in it than you think, and you can't exclude an app that doesn't exist as an object (like App Protection on the Global Secure Access client in my own usecase in the weekend here).

So I built two scripts to close the gap (can be I change some stuff in the future FYI):

> Find-MissingServicePrincipalsFromSignInLogs.ps1 - this cross-references interactive + non-interactive sign-in logs against your existing SPs and prints a ready-to-paste list of what's missing.
> CreateMissingServicePrincipals.ps1 - registers the missing SPs (with -WhatIf preview first).

A single 24-hour run on a small production tenant (my own 😄) with ~965 existing SPs surfaced dozens of gaps - apps generating sign-ins daily with nothing for policy to resolve against. See it all in the blog post here!

Key takeaways:
> Don’t assume you can exclude everything - if the service principal doesn’t exist, the app is invisible to policy enforcement
> Sign-in logs are your source of truth - if traffic flows, it should have an SP.
> Some AppIDs can't be registered (Microsoft limitation, not your config) - the script flags these as [SKIP].
> This isn't a one-time fix - build periodic discovery into your baseline.

Full write-up, scripts and the Global Secure Access exclusion list here to see more 👇

Have you any expirence with other senarios, where they was missing? 🤔 Let me hear in the comments!

#Microsoft #EntraID #ConditionalAccess #ZeroTrust #AppProtection #GlobalSecureAccess #GSA #Security #Identity #PowerShell #MVP #MVPBuzz #Community #TheBugHunter

Is anyone else having issues with mcas.ms and getting "someting went wrong" on everywhere it is?

In our Org every User is allowed to register specific Security Keys and also the MS Authenticator with Passkey option. We have one singular profile, which we also dont want to change because of security, which looks like the following:
Enforce attestation enabled, Passkey type is only Device-bound and Target specific AAGUIDs is also enabled.

Since a new Update from Microsoft which changed the process a little bit and changed the GUI from the different windows inside of the registering process you get the below window/instruction. This is really bad for us because on the one hand, it doesnt work. When I scan it and put it for example inside of the Apple Passwords. Then i get prompted to name this passkey in the end and just then this whole process doesnt continue and only throws errors. This is probably because of only Device-Bound. On the other hand why am i even allowed to put the Passkey to anything else then the MS Authenticator when our Settings inside of Entra dont allow synced Passkey in the first place........
When i disable Bluetooth on my Device this window notices it but it just presents "Bluetooth disabled".
When I am inside of the Security Informations and want to register a Passkey i even get prompted to choose the type of Securitykey. But this whole process doesnt care if i click USB-Device because if i click it then i get also the above mentioned window presented. I dont want to register anything on my phone, my user dont want to either. So why force it anyways........ This doesnt make any sense, how can this be user friendly. Spaghetti Code from A to Z...
JUST LET MY USERS REGISTER THE YUBIKEY WITHOUT ANY FORCE TO USE MS AUTHENTICATOR OR SYNCED PASSKEYS IN GENERAL.

Is it possible to disable this window? How are you handling this Microsoft slop?

Hey team, hope everyone is doing well.
Has anyone run into this issue with Microsoft Entra Cloud Sync before?
I have the Cloud Sync agent installed on a domain-joined VM. The agent services are running and the VM has normal internet access.

In Entra, the provisioning status shows:
HybridIdentityServiceAgentTimeout

I've checked the basics:
• VM is domain joined
• Logged in using a Domain Admin account
• DNS forwarding has been configured
• UPN suffix has been fixed
• Agent services are running, RSAT installed on DC
• No WinHTTP proxy
• login.microsoftonline.com:443 works
• login.windows.net:443 works
• management.azure.com:443 works
• autoupdate.msappproxy.net:443 works
• servicebus.windows.net:443 is failing

The firewall is a FortiGate. I'm looking at allowing *.servicebus.windows.net and *.msappproxy.net over TCP 443, with SSL inspection bypassed for those two endpoints.
Still no luck.
Any other bright ideas or things I should check? Has anyone had Cloud Sync working through a FortiGate and come across this exact timeout? We have recently moved towards Entra/Intune and this is our first site we are looking to Hybrid join.

Thanks!

I am really getting tired of these exams testing for edge cases that happen somewhere around 1-2% in a tenant configuration.

Where exactly would something like this be used? Can somebody give me some more context and explanation for what this question is even asking or trying to ask?

[https://i.imgur.com/giwtiK9.png\](https://i.imgur.com/giwtiK9.png)

In a production environment if I want to apply Exchange Online Plan 2 licensing to users and the users are being synced from the on-prem Active Directory, then the only steps required are:

1. to create a security group online

2. to add all the users to that group

3. and then add the Exchange Online licensing to that group

And if the users are already using a business premium license and you only want to enable some additional license eg power bi something to only a few users within that group.. Then you only need to create a new security group with those few users and add the other license to that group.

But AI tells me the answer is A - Configure the options for Exchange Online (Plan 2) on a template user.

How's that possible?

I run Zoft. Workflow automation.

Customers need to Connect Outlook / Microsoft 365 and land on a normal consent screen, not “unverified publisher.”

Need someone who has finished this for a multi-tenant SaaS:

1. Entra ID app registration (multi-tenant)
2. Publisher verification (Partner Center / CPP Partner ID on the app)
3. Microsoft Graph delegated scopes working for other tenants
4. Admin-consent path when the customer’s tenant requires it

Outlook scopes we use today: Mail.ReadWrite, Mail.Send, Calendars.Read, User.Read, offline_access. Same verified publisher will cover Teams / SharePoint / Excel later.

Please help me with setting up things.