> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Conditional Access

> Set up Conditional Access in your tenant and your clients' tenants so the Triggr service account signs in with MFA and isn't blocked.

Triggr reuses the service account's Authorize sign-in from its own servers, with no device, in your tenant and every client's. Policies must require MFA on it and must not block it.

## Your tenant

### Require MFA for the service account

<Steps>
  <Step title="Create a policy">
    In the [Microsoft Entra admin centre](https://entra.microsoft.com), as at least a Conditional Access Administrator, go to **Entra ID > Conditional Access > Policies > New policy** and name it, for example `Triggr service account - require MFA`.
  </Step>

  <Step title="Target the service account">
    Under Users, select **Include > Select users and groups > Users and groups** and choose the service account; under Target resources, include All resources (formerly All cloud apps). Leave Network unconfigured.
  </Step>

  <Step title="Require MFA and turn it on">
    Under Grant, select Grant access and **Require multifactor authentication**, set Enable policy to On and select Create.
  </Step>
</Steps>

Use Microsoft Entra MFA, or a federated provider's MFA that Microsoft Entra ID recognises. See Microsoft's [MFA requirements for partner tenants](https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements-mandating-mfa).

#### Without Conditional Access

Without a Microsoft Entra ID P1 or P2 licence, go to **Users > Per-user MFA**, select the service account and select Enable MFA ([Enable per-user MFA](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates)). Don't click Authorize from a trusted IP address, which skips MFA, and don't combine per-user MFA with Conditional Access. Security defaults don't guarantee MFA on this account.

### Don't block Triggr's use of the sign-in

Exclude the service account from any policy that:

* Requires a compliant or Microsoft Entra hybrid joined device.
* Allows only named locations or countries. Or add Triggr's [IP addresses](/security/ip-allowlist) to the named location.

What If on Policies shows which policies apply, and the non-interactive Sign-in logs under Entra ID > Monitoring & health show why a sign-in failed.

## Your clients' tenants

A client's policy that blocks the service account shows as Blocked by Conditional Access (`AADSTS53003`) on the client's GDAP Health card.

<Steps>
  <Step title="Open the client's policy">
    In the client's Microsoft Entra admin centre, go to **Entra ID > Conditional Access > Policies** and open the policy the client's sign-in logs name.
  </Step>

  <Step title="Exclude your partner tenant's service provider users">
    Under Users, open Exclude, select Guest or external users, then **Service provider users**, limit it to your partner tenant by its tenant ID or a domain, and save.
  </Step>
</Steps>

Your partner tenant ID is the TenantID on the Microsoft Graph (GDAP) Base Configuration. See Microsoft's [Conditional Access: users and groups](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups).

## Troubleshooting

<AccordionGroup>
  <Accordion title="Partner Center returns 401 MFA required">
    Check the MFA policy is On, includes the account and has no trusted-IP bypass. Then click Authorize on Microsoft Graph (GDAP) and Microsoft CSP and complete MFA.
  </Accordion>

  <Accordion title="Every client fails after a policy change in your tenant">
    Find the blocking policy in the service account's non-interactive sign-in logs and exclude the account. Then click Authorize on the Microsoft Graph (GDAP) Base Configuration card.
  </Accordion>

  <Accordion title="One client shows Blocked by Conditional Access">
    Exclude your partner tenant's service provider users, as in [Your clients' tenants](#your-clients-tenants), then click **Check now** on the client's GDAP Health card.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.