Skip to main content
Triggr reuses the service account’s Authorize sign-in from its own servers, with no device, in your tenant and every client’s. Policies must require MFA on it and must not block it.

​
Your tenant

​
Require MFA for the service account

1

Create a policy

In the Microsoft Entra admin centre, as at least a Conditional Access Administrator, go to Entra ID > Conditional Access > Policies > New policy and name it, for example Triggr service account - require MFA.
2

Target the service account

Under Users, select Include > Select users and groups > Users and groups and choose the service account; under Target resources, include All resources (formerly All cloud apps). Leave Network unconfigured.
3

Require MFA and turn it on

Under Grant, select Grant access and Require multifactor authentication, set Enable policy to On and select Create.
Use Microsoft Entra MFA, or a federated provider’s MFA that Microsoft Entra ID recognises. See Microsoft’s MFA requirements for partner tenants.

​
Without Conditional Access

Without a Microsoft Entra ID P1 or P2 licence, go to Users > Per-user MFA, select the service account and select Enable MFA (Enable per-user MFA). Don’t click Authorize from a trusted IP address, which skips MFA, and don’t combine per-user MFA with Conditional Access. Security defaults don’t guarantee MFA on this account.

​
Don’t block Triggr’s use of the sign-in

Exclude the service account from any policy that:
  • Requires a compliant or Microsoft Entra hybrid joined device.
  • Allows only named locations or countries. Or add Triggr’s IP addresses to the named location.
What If on Policies shows which policies apply, and the non-interactive Sign-in logs under Entra ID > Monitoring & health show why a sign-in failed.

​
Your clients’ tenants

A client’s policy that blocks the service account shows as Blocked by Conditional Access (AADSTS53003) on the client’s GDAP Health card.
1

Open the client's policy

In the client’s Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies and open the policy the client’s sign-in logs name.
2

Exclude your partner tenant's service provider users

Under Users, open Exclude, select Guest or external users, then Service provider users, limit it to your partner tenant by its tenant ID or a domain, and save.
Your partner tenant ID is the TenantID on the Microsoft Graph (GDAP) Base Configuration. See Microsoft’s Conditional Access: users and groups.

​
Troubleshooting

Check the MFA policy is On, includes the account and has no trusted-IP bypass. Then click Authorize on Microsoft Graph (GDAP) and Microsoft CSP and complete MFA.
Find the blocking policy in the service account’s non-interactive sign-in logs and exclude the account. Then click Authorize on the Microsoft Graph (GDAP) Base Configuration card.
Exclude your partner tenant’s service provider users, as in Your clients’ tenants, then click Check now on the client’s GDAP Health card.