This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 61%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.
Installed Apps4.Pro for Migration and the Microsoft-managed CA policy "Block device code flow" is blocking my connection to our tenant.
When I search for Microsoft Azure CLI i see a lot of attempts to use this.
What is the best practice to not have this blocked
A cloud-based identity and access management service for securing user authentication and resource access
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 92%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Hello Adriaan Kruger,
The behavior you’re seeing is expected.
Apps4.Pro is signing in using device code flow, and your tenant has the Microsoft-managed policy “Block device code flow” enabled. That’s why token issuance is blocked. The Microsoft Azure CLI entries you see in sign-in logs are part of the same process.
Instead of turning off the policy, allow only what’s needed:
If you can identify the enterprise app used by Apps4.Pro, you can exclude that app instead of the user.
If the tool supports browser-based login or app-based authentication, use that instead, as it won’t be blocked.
After the migration, remove the exclusion.
This isn’t a failure, it’s the policy working as intended. The fix is to allow access in a controlled way, not disable the policy.
Hello Adriaan Kruger,
Any update on this? Please confirm if you still have further questions.
I think the block comes from the MS‑managed CA rule cuttin the device‑code flow at the token‑gate, so just add a tiny exclde for that mig usr/app in Entra → CA. If it still fails, peek the sign‑in logs once… it shows exactly where CA drops it.