![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 16%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMF%3C/text%3E%3C/svg%3E)
Azure Cloud Services
An Azure platform as a service offer that is used to deploy web and cloud applications.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 4%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Hello M. FAJAR HARDIANTO,
Welcome to the Microsoft Q&A and thank you for posting your questions here.
I understand that your Azure Portal fails when switching tenant.
This is a decisive indicator redirect to: https://portal.azure.com.mcas.ms
That URL means the corporate tenant is routing the Azure Portal browser session through Microsoft Defender for Cloud Apps Conditional Access App Control and that rewrites protected app URLs with the *.mcas.ms suffix when sessions are protected through Conditional Access App Control / reverse proxy.- https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url, https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad
The corporate tenant administrator needs to review the affected sign-in event and remove or adjust the Conditional Access policy that applies Use Conditional Access App Control to Azure Portal / Azure management access. Conditional Access App Control is applied through Microsoft Entra Conditional Access session controls and is designed to monitor or control browser-based cloud app sessions in real time. - https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session, https://learn.microsoft.com/en-us/defender-cloud-apps/conditional-access-app-control-how-to-overview
However, the best-practice fix is to protect Azure management access with Conditional Access grant controls such as MFA, compliant device, or hybrid joined device, instead of forcing the Azure Portal tenant-switch flow through Defender for Cloud Apps reverse proxy. Azure Portal, Azure PowerShell, and Azure CLI management access are grouped under Windows Azure Service Management API for Conditional Access targeting. - https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-old-require-mfa-azure-mgmt, https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps
After the policy is corrected, the user should retry the tenant switch from a clean browser session. If the mcas.ms redirect no longer appears and the corporate tenant opens normally. If the policy is corrected and the issue still occurs, collect PortalDiagnostics.json using Ctrl + Alt + A in the Azure Portal and capture a browser trace before escalating to Microsoft Support, as these are the Microsoft-recommended diagnostics for Azure Portal troubleshooting. - https://learn.microsoft.com/en-us/azure/azure-portal/capture-browser-trace
I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.
Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.