There is a documented enforcement gap in Conditional Access policies that apply to "all resources" but have an exclusion for at least one resource.

https://dirkjanm.io/bypassing-conditional-access-with-resource-exclusio

#infosec #cybersecurity #redteam #pentest #cloud