AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance

[brijshah2709]

Microsoft.Identity.Web Library

Microsoft.Identity.Web.TokenAcquisition

Microsoft.Identity.Web version

2.13.2

Web app

Sign-in users

Web API

Protected web APIs call downstream web APIs

Token cache serialization

Not Applicable

Description

We have a full stack application where front end calls our backend using app resource with user context and backend exchanges token for downstream api calls via TokenAcquisition.GetAuthenticationResultForUserAsync. While doing so we get this error:

"AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.\r\nTrace ID: 64908389-2527-4188-8ba4-29b9e76e3c00\r\nCorrelation ID: a400dd29-ad31-4de1-933e-3e3995a7c6cc\r\nTimestamp: 2023-08-03 18:11:29Z","Data":{},"InnerException":null,"HelpLink":null,"Source":"Microsoft.Identity.Client","HResult":-2146233088,"StackTrace":"
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.HandleTokenRefreshErrorAsync(MsalServiceException e, MsalAccessTokenCacheItem cachedAccessTokenItem)\r\n

Trying to understand how backend can request token for such resources without having customer to disabled CA policy.

Reproduction steps

1. Create conditional access policy.
2. Request token using TokenAcquisition.GetAuthenticationResultForUserAsync
3. See error on authResult.

Error message

"AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.\r\nTrace ID: 64908389-2527-4188-8ba4-29b9e76e3c00\r\nCorrelation ID: a400dd29-ad31-4de1-933e-3e3995a7c6cc\r\nTimestamp: 2023-08-03 18:11:29Z","Data":{},"InnerException":null,"HelpLink":null,"Source":"Microsoft.Identity.Client","HResult":-2146233088,"StackTrace":"
at Microsoft.Identity.Client.Internal.Requests.RequestBase.HandleTokenRefreshErrorAsync(MsalServiceException e, MsalAccessTokenCacheItem cachedAccessTokenItem)\r\n

Id Web logs

n/a

Relevant code snippets

var authResult = await TokenAcquistionRetryPolicy().ExecuteAsync(() =>
{
    return TokenAcquisition.GetAuthenticationResultForUserAsync(scopes,
                    TokenAcquisitionParams.AuthenticationScheme,
                    tenantId,
                    TokenAcquisitionParams.UserFlow,
                    null);
}).ConfigureAwait(false);

Regression

n/a

Expected behavior

Should return access token.

[jmprieur]

brijshah2709 : this is the expected behavior.
It's AAD that decides that the conditional access policy should block the token acquisition (not the library).
Does MSAL return An MsalUiRequiredException? Or not, if yes, what is the SubError? Is the Claims member null?

The guidance is to use a more appropriate conditional access policy.

[brijshah2709]

Jean-Marc Prieur (@jmprieur) thank you for your response.

Yes it is MsalUiRequiredException here's the detailed log: ","Exception":{"MsalUiRequiredException":{"Classification":"MessageOnly","StatusCode":400,"Claims":"{"access_token":{"capolids":{"essential":true,"values":["bac58a15-22ba-4a2b-b107-8fb3c806622a"]}}}"

Let me know if you need more information. I understand that AAD decides this based on policy setup but we are trying to understand what is the best way to handle this from service level? or if UI can ask for any more consent or logins to prevent this on retry?

[brijshah2709]

Jean-Marc Prieur (@jmprieur) wanted to check on this if we can use claims property in any way to show login consent or something to resolve this?

[jmprieur]

Is it a web API? or a web app?

[brijshah2709]

Jean-Marc Prieur (@jmprieur) It is a .net core web app.

[jmprieur]

Then, if you use the [AuthorizeForScope] attribute, it should do it for you.
See https://github.com/AzureAD/microsoft-identity-web/wiki/Managing-incremental-consent-and-conditional-access

[jmprieur]

brijshah2709 : closing, as I believe we answered
Feel free to reopen if you disagree.