Since around June 2026, due to a Microsoft specification change, an issue has occurred where Conditional Access policies configured to exclude CatoPortal are no longer enforced as intended.
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-enforcement-resource-exclusions
We understand that this issue was caused by CatoPortal requesting the baseline directory scope (User.Read).
We also understand that CatoPortal has since been updated and no longer requests User.Read.
However, the KB currently states that CatoPortal requires User.Read permission.
https://knowledge.catonetworks.com/docs/configuring-azure-sso-for-your-account#required-permissions
Would it be possible to update the KB to accurately explain the scopes that CatoPortal currently requests?
