even if Application is exculed in CA then also CA is blocking the request for that application

The most common reason for this behavior is that Conditional Access evaluates all resources involved in the sign-in, not just the single app that was explicitly excluded. Even if the target application is excluded, the sign-in can still be blocked when:

1. Service dependencies are in scope of the policy
   • Many apps call other Microsoft resources during sign-in (for example, Azure Portal → Azure Resource Manager; Teams → SharePoint, Exchange, etc.).
   • If the CA policy applies to any of these dependent resources, the policy is still enforced and can block access.
   • To verify this, open Microsoft Entra ID → Sign-in logs, select the failed sign-in, and on the Conditional Access tab review:
     • Application and Resource values (service dependency)
     • Audience list (all resources requested as part of that sign-in)
   • If any of those resources are still in scope of the “require compliant device” policy, the sign-in will be blocked even though the main app is excluded.
2. Audience reporting shows another resource triggering the policy
   • In the sign-in log entry, under Resource → Audience, check all audiences listed.
   • If one of those audiences is covered by the CA policy (and not excluded), that policy will apply and can block the request.
3. The wrong object is excluded (app vs. service principal)
   • Some scenarios (for example, Defender/Global Secure Access mobile client) require excluding specific service principals or app IDs, not just a generic app selection.
   • For Defender/Global Secure Access, Microsoft recommends explicitly excluding:
     • MicrosoftDefenderATP XPlat app (a0e84e36-b067-4d5c-ab4a-3db38e598ae2)
     • Microsoft Defender for Mobile TVM app (e724aa31-0f56-4018-b8be-f8cb82ca1196) when Threat & Vulnerability Management is used.
   • Ensure the correct app IDs/service principals are created and then excluded in the CA policy.
4. Global or overly broad CA policies still apply
   • If there are other CA policies targeting All users / All resources with controls like Require device to be marked as compliant, they can still block access even if one policy excludes the app.
   • Review all active CA policies to confirm no other policy is:
     • Targeting the user and
     • Targeting any of the resources/audiences involved in the sign-in.
5. How to troubleshoot and fix
   1. Go to Entra ID → Sign-in logs, open the failed sign-in.
   2. On the Conditional Access tab, identify:
      • Which policy caused the block.
      • Which resource/audience is in scope of that policy.
   3. Either:
      • Add the missing dependent resources to the Excluded cloud apps list of the policy, or
      • Create a separate, more targeted policy for that app, or
      • Adjust scope so that only the intended app/resources are protected by the compliant-device requirement.
   4. If using Defender/Global Secure Access or Defender for Endpoint mobile, ensure the recommended Defender app/service principals are excluded so posture reporting and Global Secure Access client are not blocked.

This approach ensures the exclusion is effective across all resources actually used during the sign-in, not just the primary application.

References:

• Troubleshoot sign-in problems with Conditional Access
• Resources for Microsoft Defender for Endpoint for mobile devices
• Enable compliant network check with Conditional Access
• Require a compliant device, Microsoft Entra hybrid joined device, or multifactor authentication for all users
• Require approved client apps or app protection policy
• Block unknown or unsupported device platform