Conditional Access blocks service account unexpectedly

Scenario

An automation workflow stops after a Conditional Access change begins applying MFA or device requirements to a service identity.

Recommended Resolution Path

1. Confirm the identity should be a workload identity rather than a human user account.
2. Exclude only the specific app or identity with documented justification.
3. Move unattended auth to certificates, managed identity, or app registrations where possible.
4. Add monitoring for sign-in failures to catch policy drift earlier.

Technician Notes

Confirm the business impact, document the root cause, and capture any preventative follow-up in the PSA or client knowledge base.