MC1029989 – M365 Change Digest

One-line summary

In March 2026, Entra ID and Intune will retire the 'Require approved client app' Conditional Access control; switch to 'Require application protection policy' instead.

Similar updates

Details

Summary

"Require approved client app" control in Microsoft Entra Conditional Access will be retired in March 2026. Organizations should update their policies to use the "Require application protection policy" grant control. For more information, visit the provided link.

ExternalLink

http://aka.ms/RetireApprovedClientApp

Body (from Message Center)

As mentioned in MC540749, in March 2026, Microsoft Entra ID (formerly known as Azure Active Directory) and Microsoft Intune will retire the Conditional Access “Require approved client app” grant control. Instead we recommend utilizing the "Require application protection policy" grant control, which provides the same data loss and protection with additional benefits.

[How this will affect your organization:]

If you have a Conditional Access policy with "Require approved client app" grant control configured, after this change, you will no longer be able to enforce this control, it will be as if this grant is not selected.

[What you need to do to prepare:]

We recommend updating your Conditional Access policy to using the "Require application protection policy" grant control. For more information, see Migrate approved client app to application protection policy in Conditional Access.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-03-01T00:00:00Z",
    "ai_actions": [
      "Update Conditional Access policies",
      "Switch to \u0027Require application protection policy\u0027 grant"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "In March 2026, Entra ID and Intune will retire the \u0027Require approved client app\u0027 Conditional Access control; switch to \u0027Require application protection policy\u0027 instead.",
    "ai_topics": [
      "Intune",
      "Entra"
    ],
    "category": "planForChange",
    "details_map": {
      "ExternalLink": "http://aka.ms/RetireApprovedClientApp",
      "Summary": "\"Require approved client app\" control in Microsoft Entra Conditional Access will be retired in March 2026. Organizations should update their policies to use the \"Require application protection policy\" grant control. For more information, visit the provided link."
    },
    "id": "MC1029989",
    "importance": 5,
    "is_major_change": false,
    "last_modified": "2025-03-12T23:05:10Z",
    "ms_products": [
      "Intune"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Intune"
    ],
    "severity": "normal",
    "tags": [
      "Admin impact",
      "Retirement"
    ],
    "title": "Reminder: \"Require approved client app\" control in Microsoft Entra Conditional Access will be retired in March 2026"
  }
}