unable to exclude device group from conditional access policy Microsoft Entra ID

Yes - but you have to use the approach described at https://zcusa.951200.xyz/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices in the Common scenarios section

This is because (as explained there) "Microsoft Entra ID uses device authentication to evaluate device filter rules. For a device that is unregistered with Microsoft Entra ID, all device properties are considered as null values and the device attributes cannot be determined since the device does not exist in the directory. The best way to target policies for unregistered devices is by using the negative operator since the configured filter rule would apply. If you were to use a positive operator, the filter rule would only apply when a device exists in the directory and the configured rule matches the attribute on the device."

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Hello @Prashant Mishra,

Thank you for posting your query on Microsoft Q&A.

Based on the attached screenshots, it appears you are attempting to exclude Azure AD-registered devices from a Conditional Access (CA) policy using the extensionAttribute1 property with the value PK-Lab-Device.

Even though you have added the extensionAttribute1 property to the exclusion list in the CA policy, it seems the policy is not excluding the device as expected. Please note that when using extensionAttributes, there is a limitation: the devices must be managed by Microsoft Intune for the CA policy to evaluate and exclude them correctly.

For more details, refer to the document: Supported operators and device properties for filters

If the devices are not managed by Intune, you can consider the following workarounds: Use other supported device attributes, such as device.trustType: device.trustType -eq "Workplace" or else If you need to target specific devices, you can filter using their deviceId: device.deviceid -eq "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb".

If the devices are managed by Intune and the issue persists, let me know, and we can investigate further by verifying the logs offline.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.