diff --git a/articles/entra-conditional-access-integration.md b/articles/entra-conditional-access-integration.md index 6700e9a631..f37017adff 100644 --- a/articles/entra-conditional-access-integration.md +++ b/articles/entra-conditional-access-integration.md @@ -182,12 +182,9 @@ As an example, you can create a policy to "block access to Office 365 on macOS d Make sure to assign the "Fleet conditional access" group to the Entra policy. -### Disabling "Conditional Access" on a team +## Disable -If you need all your hosts on a team to be marked as "Compliant" (e.g. to unblock access to a resource) go to **Policies > Select team > Automations > Conditional access**, uncheck all policies, and select **Save**. The hosts will be marked as "Compliant" the next time they check in with policy results (within one hour, or by refetching manually). - -To disable the "Conditional Access" feature on a team head to **Policies > Select team > Automations > Conditional access > Disable**. -Once disabled, hosts will not be reporting compliance status to Entra anymore. +If you want to unblock all end users, you can disable conditional access by heading to Entra and turning off the ["Conditional Access" Entra policies](#step-6-add-entra-policies). ## End user experience diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 259e211a96..8fc2645222 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -941,7 +941,7 @@ Returns an Apple configuration profile file with `Content-Type: application/x-ap ### Delete Microsoft Entra ID -Fleet will be disconnected from Microsoft Entra and will stop blocking end users from logging in with single sign-on. +Disconnects Fleet from Entra. This won't unblock end users failing policies. Learn how to [unblock end users](https://fleetdm.com/guides/entra-conditional-access-integration#disable). `DELETE /api/v1/conditional-access/microsoft` diff --git a/frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx b/frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx index ee059902c4..b4f3cbe14a 100644 --- a/frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx +++ b/frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx @@ -73,8 +73,16 @@ const DeleteConditionalAccessModal = ({ > <>

- Fleet will be disconnected from Microsoft Entra and will stop blocking - end users from logging in with single sign-on. + Before you delete, first unblock all end users.{" "} + +

+

+ If you don't, end users will stay blocked even after deleting + Entra.