Conditional Access Naming Convention & Implementation Standard
Microsoft Entra ID · Governance Standard
Conditional Access
Naming Convention & Implementation Standard
This document defines a unified naming convention, numbering ranges, policy examples, and a safe rollout process for Microsoft Entra Conditional Access.
Document Purpose
To create a single, clear language for every Conditional Access policy in the organization, so anyone can quickly understand a policy's purpose, its target population, the resource it protects, and the control it applies.
Important: The number at the start of a policy name is for ordering,
documentation, and management only. It does not determine Conditional Access priority
or processing order.
Recommended Naming Structure
CA-<Number>-<Audience>-<Resource>-<Action>-<Condition>
Example
CA-020-ALL-AllResources-Require-MFA
Guiding Principles
- Short, readable, unambiguous name.
- Fixed three-digit number at the start of the name.
- Consistent codes for audiences and resources.
- Never include policy state, date, or an employee's name in the name.
- Every policy includes a full description, an Owner, and a Change Reference.
Agreed Codes
| Code | Meaning | Example |
|---|---|---|
| ALL | All users | CA-020-ALL-AllResources-Require-MFA |
| ADM | Admins and sensitive-role holders | CA-010-ADM-AllResources-Require-PhishingResistantMFA |
| EXT | Guests and external users | CA-030-EXT-AllResources-Require-MFA |
| SVC | Interactive service accounts | CA-090-SVC-AllResources-Block-InteractiveSignIn |
| PRV | Privileged users | CA-080-PRV-SensitiveApps-Session-SignInFrequency |
| DEV | Pilot or test group | CA-900-DEV-M365-Require-CompliantDevice |
| M365 | Microsoft 365 | CA-040-ALL-M365-Require-CompliantDevice |
| AzureMgmt | Microsoft Azure Management | CA-011-ADM-AzureMgmt-Require-PhishingResistantMFA |
| AllResources | All cloud resources | CA-001-ALL-AllResources-Block-LegacyAuth |
Number Range Allocation
| Range | Category | Examples |
|---|---|---|
| 001–009 | Baseline blocks | Legacy Authentication, Unknown Platforms |
| 010–019 | Admins and privileged accounts | Phishing-resistant MFA, Azure Management |
| 020–029 | MFA for all users | All users MFA, Registration protection |
| 030–039 | Guests and external users | Guest MFA, External access restrictions |
| 040–049 | Device Compliance and Device Trust | Compliant device, Hybrid joined device |
| 050–059 | Locations and networks | Countries, Trusted locations, Named locations |
| 060–069 | Identity Protection and Risk | Sign-in risk, User risk |
| 070–079 | Sensitive applications | Finance, HR, Admin portals |
| 080–089 | Session Controls | Sign-in frequency, Persistent browser |
| 090–099 | Workload Identities and service accounts | Service principals, Interactive service accounts |
| 900–949 | Pilot and temporary policies | Pilot, Staging, Migration |
| 950–999 | Emergency policies | MFA outage, Compliance outage, Federation outage |
Recommended Baseline
CA-001-ALL-AllResources-Block-LegacyAuth
Block
All Users
Blocks Legacy Authentication protocols for all users.
CA-010-ADM-AllResources-Require-PhishingResistantMFA
Require
Admins
Requires a phishing-resistant Authentication Strength for sensitive roles.
CA-011-ADM-AzureMgmt-Require-PhishingResistantMFA
Require
Azure Management
Hardens access to Azure Management and administrative portals.
CA-020-ALL-AllResources-Require-MFA
Require
All Users
Requires MFA for all users across all cloud resources.
CA-030-EXT-AllResources-Require-MFA
Require
External
MFA for guests and external users, per Cross-tenant trust settings.
CA-040-ALL-M365-Require-CompliantDevice
Require
Device Trust
Access to Microsoft 365 from a Compliant device only, after a controlled Pilot.
CA-050-ALL-AllResources-Block-DisallowedCountries
Block
Locations
Blocks countries not approved under organizational policy.
CA-060-ALL-AllResources-Require-MFA-MediumHighSignInRisk
Require MFA
Risk
Requires MFA for sign-ins at medium and high risk levels.
CA-061-ALL-AllResources-Block-HighUserRisk
Block
High User Risk
Blocks users with high User Risk, or redirects them to a Secure Password Change flow.
CA-080-PRV-SensitiveApps-Session-SignInFrequency
Session
Privileged
Sets re-authentication frequency for sensitive applications and privileged users.
Recommended Groups
SG-CA-Pilot-Users SG-CA-Pilot-Admins SG-CA-Exclude-EmergencyAccess SG-CA-Exclude-Temporary SG-CA-ServiceAccounts-Interactive SG-CA-Require-CompliantDevice SG-CA-SensitiveApps-Users
Emergency Access Accounts
- At least two separate cloud-only accounts.
- Excluded from every policy that could block sign-in.
- Credentials stored in a secure, controlled location.
- Periodic sign-in testing with documented results.
- Alerting on any use of these accounts.
Emergency Policies
These policies are kept disabled and are only activated per an approved Runbook.
ENABLE IN EMERGENCY-950-MFAServiceOutage-01-Allow-TrustedLocations ENABLE IN EMERGENCY-951-DeviceComplianceOutage-02-Require-MFA ENABLE IN EMERGENCY-952-FederationOutage-03-Allow-CloudAdmins
Every emergency policy must have an Owner, activation conditions, a defined sequence
of actions, a required approval, and a process to return to normal operations.
What Not to Put in a Policy Name
| Not Recommended | Reason |
|---|---|
| ReportOnly / Enabled / Disabled | Policy state changes throughout its lifecycle. |
| Test1 / Test2 / Final | Doesn't explain the policy's purpose and isn't suitable for Production. |
| MFA Policy New | A generic name that doesn't identify Scope, Audience, or Control. |
| An employee's name | Creates dependency on a person and isn't suitable for organizational governance. |
| Creation date | The date belongs in the Description or the change management system. |
| A changing version number | Makes auditing and comparison over time harder. |
Description Template for Every Policy
Purpose: Require MFA for all standard users. Owner: Identity and Security Team. Business owner: IT Security. Scope: All users and all resources. Exclusions: Emergency Access and approved service accounts. Ticket/Change: CHG-000000. Created: YYYY-MM-DD. Last reviewed: YYYY-MM-DD. Review cycle: Quarterly. Rollback: Disable policy and validate emergency access.
Safe Rollout Process
Map the Current State
Export and document all existing Conditional Access policies, exclusions, groups, and Named Locations.
Export and document all existing Conditional Access policies, exclusions, groups, and Named Locations.
Prepare Emergency Access
Create and test two emergency accounts before making any change.
Create and test two emergency accounts before making any change.
Build Pilot Groups
Separate regular users, admins, guests, and Device Trust scenarios.
Separate regular users, admins, guests, and Device Trust scenarios.
Create Policies in Report-only Mode
Test impact without actually blocking anyone.
Test impact without actually blocking anyone.
Review Sign-in Logs and What If
Identify unexpected blocks, legacy applications, and service accounts.
Identify unexpected blocks, legacy applications, and service accounts.
Enable for Pilot
Gradually switch to On for a small, controlled group.
Gradually switch to On for a small, controlled group.
Roll Out in Stages
Expand to additional departments based on results and an approved Change.
Expand to additional departments based on results and an approved Change.
Quarterly Review
Review policies, exclusions, emergency accounts, risks, and business changes.
Review policies, exclusions, emergency accounts, risks, and business changes.
The Final Standard
Approved template:
CA-###-Audience-Resource-Action-ControlOrCondition
CA-001-ALL-AllResources-Block-LegacyAuth CA-010-ADM-AllResources-Require-PhishingResistantMFA CA-011-ADM-AzureMgmt-Require-PhishingResistantMFA CA-020-ALL-AllResources-Require-MFA CA-030-EXT-AllResources-Require-MFA CA-040-ALL-M365-Require-CompliantDevice CA-050-ALL-AllResources-Block-DisallowedCountries CA-060-ALL-AllResources-Require-MFA-MediumHighSignInRisk CA-061-ALL-AllResources-Block-HighUserRisk CA-080-PRV-SensitiveApps-Session-SignInFrequency