Authentication flows as a condition in Conditional Access policy

Publisher

Microsoft

URL

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows

Published

2026-03-24

Updated

unknown

Accessed

2026-09-30

HTTP status

200

License

Microsoft Learn terms of use; copyright Microsoft (licence text not inspected); no-redistribution; short excerpts and locators only

Source notes citing this source

• Error AADSTS530036 indicates that a refresh token is invalid because of authentication flow checks by Conditional Access; Microsoft lists it as the way to recognise a protocol-tracking block when the authentication flows policy applies to all applications. in context
• Microsoft Entra documents blocks on protocol-tracked sessions as expected behaviour whose impact can include complete device sign-out, with no recommended remediation while the policy is enabled; if the policy was set to disabled or report-only a fresh token may be needed to use the device again. in context
• Since early September 2024 Microsoft enforces authentication flows policies on the Device Registration Service when the policy targets all resources, and organisations that use device code flow for device registration must exclude Device Registration Service from such a policy to avoid impact. in context
• Microsoft Entra guidance recommends blocking device code flow wherever possible and allowing it only where necessary. in context
• Microsoft Entra guidance gives as an example that where device code flow is used for Android-based conference room devices, it can be blocked everywhere except for Android devices in a specific network location. in context
• A session established with device code flow is protocol tracked, the tracked state persists through token refreshes, and later requests in that session that do not use device code flow can still be blocked by an authentication flows policy. in context
• Error AADSTS530036 means a refresh token is invalid because of Conditional Access authentication flow checks (protocol tracking); with the policy enabled Microsoft gives no remediation, and after disabling it or setting it to report-only a fresh token may be needed. in context
• An Entra authentication flows policy that blocks device code flow for all resources is likely to block SIP Gateway pairing unless the SIP Gateway apps or site are excluded, because SIP Gateway pairing follows the device authorization grant pattern; Microsoft's SIP Gateway pages do not state this directly. inferred in context
• Microsoft Entra Conditional Access can target device code flow as an authentication flow condition, and Microsoft recommends blocking device code flow wherever possible and allowing it only where necessary. in context
• To see whether device code flow is used, Microsoft suggests running the Conditional Access policy in report-only mode or filtering Entra sign-in logs with the Authentication protocol filter; the Conditional Access tab of a blocked sign-in shows whether an authentication flows policy matched. in context

Cite this source record

APA

WarmTransfer. (2026, March 24). Authentication flows as a condition in Conditional Access policy. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-entra-authentication-flows-concept

BibTeX

@misc{warmtransfer-ms-entra-authentication-flows-concept,
  title  = {Authentication flows as a condition in Conditional Access policy},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-entra-authentication-flows-concept},
  note   = {Microsoft, accessed 2026-09-30}
}