Block unknown and unsupported platforms
Block unknown client platform claims with a carefully tested Conditional Access policy.
Attackers using axios hate this one weird trick.
Blocking unknown or unsupported device platforms can catch clients that don’t identify themselves as an operating system your organization supports. It’s a useful layer even though an attacker can change the user agent.
Microsoft has a built-in Conditional Access template for this. The important bit is Include: Any device, then Exclude: the platforms your organization actually uses. The block applies to what’s left, including unknown platforms. Selecting individual platforms to block would miss clients Entra can’t identify.
Start in Report-only:
- Target All users, exclude your emergency access accounts, and target All resources without resource exclusions.
- Configure the device-platform condition as above and select Block access.
- Review the report-only sign-ins for legitimate automation, help desk tools, and other clients with unrecognized user agents. Fix the client or document any necessary, narrow service-account exception before enabling the policy.
The platform claim comes from unverified client information. A Windows-looking user agent isn’t proof of a managed Windows device. Keep separate policies requiring device compliance or supported app protection controls; this block doesn’t replace them.
A user-targeted policy doesn’t govern app-only service principal calls.
Microsoft’s policy walkthrough | Device-platform limitations
Original posts: 29 November 2024 and template reply. Documentation checked 14 October 2026.