[BUG] Conditional Access Policy not working

[sonnenx]

Reporting an Issue or Missing Feature

I have registered a PnP management shell with AzureAD.
I want to create a Conditional Access Policy that only allows Connect-PnPonline access from named locations.
I created a dedicated CAP and pointed to the PnP Management Shell application.
The policy seems ok when I check it with the WhatIf option, but in practice it doesn't work. The policy reports that the indicated PnP Management Shell application is Not matched/not included.
If the policy indicated all cloud applications, the PnP Management Shell application is matched correctly.

Expected behavior

The application PnP Management Shell should be matched correctly,

What is the version of the Cmdlet module you are running?

(you can retrieve this by executing Get-Module -Name "PnP.PowerShell" -ListAvailable)

ModuleType Version PreRelease Name PSEdition ExportedCommands

---

Manifest 2.2.6 nightly PnP.PowerShell Desk {Add-PnPAdaptiveScopeProperty, Add-PnPP…

Which operating system/environment are you running PnP PowerShell on?

• [X ] Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[MichaelRyan87]

hey @sonnenx, did you find an answer for this one?

I'm running into exactly the same issue whilst trying to block PnP Online through CA policies.

[markgort86]

Why not just block PowerShell only for the most users? For example: https://learn.microsoft.com/en-us/schooldatasync/blocking-powershell-for-edu or https://call4cloud.nl/2020/11/the-conditional-access-experiment/.

I also tried to create CA Policy because of this discussion. But with the same result (see screenshot). The steps are the following: created a new policy, assigned all users added the PnP Management Shell, and blocked access.