Microsoft 365 Conditional Access Policies (CAP) and OAuth

Background

Microsoft 365/Azure Conditional Access Policies (CAP) are security rules in Microsoft Entra ID (formerly Azure Active Directory) that determine how users can access cloud applications and resources. There are many ways these can be used, but one is to restrict access to specific IP addresses (or reject unknown addresses).

When using the hosted version of the P11D Organiser, the software is actually running on our infrastructure, meaning that the OAuth authorisation request will be coming from our IP address range - if your organisation has Conditional Access Policies in place that restrict IP addresses, this will cause an issue.

Solution

You would need to add the outgoing IP address of our servers to the access list that is in place to allow the system to communicate with your Entra ID so that authorisation can be provided.

The IP address that needs to be whitelisted is 85.90.254.18.