ZTCA Configuration: Manage QuickBooks Online access controls and IP restrictions using native and network-level controls

This guidance explains that QuickBooks Online does not support SAML/OIDC single sign-on with Microsoft Entra ID, preventing Conditional Access enforcement; it outlines mitigation options—QuickBooks Advanced user management, network-level IP blocking of app.qbo.intuit.com, and password-vaulting SWA via third-party IdPs—and recommends a layered approach (native MFA, strict user lifecycle, network restrictions, or SWA) to reduce access risk.