The constellation problem
The Teams client acquires tokens for Teams itself AND Exchange (calendar/ mail-backed features) AND SharePoint (files) AND Graph. Two design consequences:
- The hole: a CA policy targeting only the "Microsoft Teams" app leaves the same data reachable via Outlook/SPO paths — the standard guidance is targeting the Office 365 app GROUP so the constellation moves together.
- The loop: a policy satisfied for Teams but failing for a dependency (e.g., device compliance demanded by SPO's policy but not Teams') produces the half-signed-in client — chat works, Files tab spins, calendar empty — the signature of MISMATCHED policies across the constellation, and the ticket reads "Teams is broken" every time.
Patterns that work
- One policy set over the Office 365 group: require compliant device OR approved client + app protection (the MAM concept's partner) for all four services identically.
- Room/CAP/resource accounts get their own treatment (documented exclusions or tailored policies) — the recurring Monday outage from the security sweep (devices concepts) is a CA targeting miss.
- Guest-scoped policies: guests hit YOUR CA — an MFA demand they can satisfy (or trust settings honouring their home MFA, per the B2B concept), or a quiet wall.
- Network/location conditions interplay with split-tunnel designs: a 'trusted-IP only' condition breaks precisely when media bypass sends users direct — align the network model and CA conditions deliberately.
What to watch (proofs)
- The failure named: Entra sign-in logs for the user around the incident — each entry names the app, the policy evaluated, the grant that failed; "which policy broke Teams" is a filter, not a debate.
- The mismatch detector: sign-in log entries for the SAME user, SAME hour, across Teams/SharePoint/Exchange apps — divergent CA outcomes across them = the loop's fingerprint.
- Pre-flight for policy changes: CA report-only mode results filtered to the Teams constellation + resource-account list BEFORE enforcement — the Monday outage, previewed and prevented.
- Resource-account collisions: sign-in failures for room/CAP accounts post-rollout (the devices concepts' playbook) — an alert on that query is cheap insurance.