guides-Conditional access

🎯 What is Conditional Access?

Conditional Access (CA) is the Policy Engine of Microsoft Entra ID. It lets you define: "Who, What, From Where, and Under What Conditions — can access a resource."

Unlike a traditional firewall that blocks by IP, CA understands identity, device, application, and location — enabling granular decisions: Allow, Require MFA, Require managed device, or Block.

📡

Signals

User, location, device, application, identity risk, sign-in risk

🤖

Decision

Allow / Require MFA / Require compliant device / Block

🛡️

Enforcement

Microsoft Entra ID issues or denies the access token

🏗️ Architecture — Request Flow

👤

User Signs In

Any client

→

📡

Signal Collection

Identity, IP, device, app

→

🔍

Policy Evaluation

All applicable policies

→

🤖

Decision

Grant / Block / Session

→

🎟️

Token Issued

With appropriate claims

ℹ️

Policy Accumulation Principle

When multiple policies apply to the same user, the most restrictive requirement wins. If CA-001 requires MFA and CA-002 requires a compliant device, the user needs both MFA AND a compliant device.

🧩 Policy Components

Assignments (Who)

👥 Users/Groups — who the policy applies to
🏢 Workload Identities — Service Principals
☁️ Cloud Apps — which applications
📍 Conditions — additional filters (see below)

Conditions

⚡ User Risk — P2 — leaked credentials, compromised account
🔒 Sign-in Risk — P2 — anomalous sign-in behavior
📱 Device Platforms — Windows, iOS, Android...
📍 Locations — Named Locations / Any location
💬 Client Apps — Browser, Mobile Apps, Legacy
💻 Device State — Compliant, Hybrid joined
🔗 Authentication Flows — Device code flow

Grant Controls (What to require)

🚫 Block access
📲 Require MFA
✅ Require compliant device
🔗 Require Hybrid Azure AD joined
✔️ Require approved client app
🛡️ Require app protection policy
🔑 Require password change
🪪 Require Authentication Strength

Session Controls

⏱️ Sign-in Frequency — re-auth every X hours/days
🚫 Persistent Browser Session — prevent "stay signed in"
🌐 MCAS/Defender Integration — App Control
📋 Token Protection — P2
⬇️ Disable download/print/copy — via MCAS

📜 License Requirements

Feature	License	Notes
Conditional Access itself	P1	Included in M365 Business Premium, E3+
User Risk / Sign-in Risk	P2	Requires Entra ID Protection
Token Protection	P2	Preview / GA
Authentication Strength (Custom)	P1	Built-in strengths are free
Workload Identity CA	P2 + addon	Workload Identities Premium add-on
Named Locations	P1
App Protection Policy in CA	P1 + Intune	MAM without MDM
MCAS Session Controls	P1 + Defender for Cloud Apps	Included in M365 E5

🏷️ Naming Convention

Consistent naming is critical for manageability — especially when you have dozens of policies.

Prefix

CA

-

Number

001

-

Action

Require-MFA

-

Target

AllUsers

-

Condition

AllApps

Naming Examples

CA-001-Require-MFA-AllUsers-AllApps
CA-002-Block-Legacy-Auth-AllUsers
CA-010-Require-Compliant-Device-AllUsers-Office365
CA-020-Require-MFA-Admins-AllApps
CA-030-Block-HighRisk-Users-AllApps
CA-040-Session-Limit-8h-External-SharePoint
CA-999-BREAKGLASS (not a policy — it's the exclusion group)

💡

Tip: Use Number Ranges

Reserve ranges: 001-009 for basic identity policies, 010-019 for device, 020-029 for admins, 030-039 for risk-based, 040-049 for session. This makes it easy to insert new policies later.

⚠️ Break Glass Accounts

🚨

Rule #1: Always Exclude Break Glass from Every Policy!

If you misconfigure a CA policy and lock yourself out — Break Glass is your emergency key. Without it, the Azure portal will be inaccessible to you.

Setting Up Break Glass

Create 2 dedicated accounts
Use names like breakglass1@domain.onmicrosoft.com — use *.onmicrosoft.com so they're not dependent on federation. Strong password, 30+ characters, unique.
Assign Global Admin role
Without PIM activation requirements — they must work when everything else is broken.
Exclude from every CA Policy
Create a group CA-BreakGlass-Exclude → add both accounts → add this group to the Exclude section of every CA policy.
No MFA, No Device Compliance
The long, complex password IS the protection — not MFA. If MFA infrastructure breaks, Break Glass should still work.
Set an alert on every sign-in
Any sign-in on a Break Glass account should trigger an alert. Configure a KQL alert in Sentinel/Log Analytics.
Store physically
The password lives in a physical safe, NOT in a password manager that can be locked out alongside everything else.

KQL — Alert on Break Glass Sign-in

SigninLogs
| where UserPrincipalName in ("breakglass1@yourdomain.onmicrosoft.com", "breakglass2@yourdomain.onmicrosoft.com")
| project TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType, AppDisplayName
| order by TimeGenerated desc

📊 Report-Only Mode

Report-Only is a mode where the policy reports what it would have done — without enforcing it. Essential before enabling any new policy.

✅

Report-Only Success

The policy would have succeeded — the user met the requirements

❌

Report-Only Failure

The policy would have blocked — without actually blocking

Recommended Workflow

Enable in Report-Only
Every new policy starts as Report-Only
Monitor for 7–14 days
Check Sign-in Logs → Conditional Access tab → see how many sign-ins would have been blocked
Tune exceptions
Add Exclude for service accounts, pipeline agents, specialized devices
Switch to Enabled
Once you're confident there are no false positives

🧪 What If Tool

The What If tool in Entra ID lets you simulate: "If user X signs in from Y to application Z — which CA policies would apply?"

Where to Find It

Entra Admin Center → Protection → Conditional Access → What If

🎯

Input Parameters

User, Cloud App, IP/Location, Device Platform, Client App, Sign-in Risk level

📋

Output

List of applicable policies, what they require, and what the net outcome would be

💡

Always Test Before Enforcing

Before any change — run What If against Break Glass accounts, service accounts, and regular users. Confirms there are no unexpected lockouts.

📍 Named Locations

Named Locations let you define IP ranges or countries that carry specific meaning (Office, Trusted network, Block-listed regions).

IP Ranges

🏢 Corporate Office — known IPs, mark as Trusted
🏠 VPN Range — when using split-tunnel VPN
🚫 Block List — known malicious ISPs/ASNs

Country Locations

🌍 Allowed Countries — US, UK, EU, Israel
⛔ Blocked Regions — countries you don't expect logins from
⚠️ Unknown Countries — Tor, anonymizers

⚠️

GeoIP is Not Perfect

VPNs, Tor, and some CDNs can bypass Country Blocking. Use it as an additional security layer, not the only one.

🧑 Identity Policies

CA-001 Require MFA — All Users, All Apps

RequiredP1

▾

The foundation of every CA architecture. MFA for all interactive sign-ins, for all users, for all applications.

Setting	Value
Users	All users — Exclude: BreakGlass Group, Service Accounts Group
Cloud Apps	All cloud apps
Conditions	—
Grant	Require multifactor authentication
Session	—
Mode	Report-Only → Enabled after 14 days

⚠️

Set Up MFA Registration Policy First!

Before enforcing, ensure all users are registered for MFA — via Entra ID Protection → MFA Registration Policy.

CA-002 Block Legacy Authentication

RequiredP1

▾

Legacy Auth (SMTP AUTH, POP3, IMAP, Basic Auth) doesn't support MFA — it's a primary attack vector. Block it completely.

Setting	Value
Users	All users — Exclude: BreakGlass, Legacy Service Accounts
Cloud Apps	All cloud apps
Conditions → Client Apps	Exchange ActiveSync clients + Other clients
Grant	Block access

ℹ️

Check Sign-in Logs First

Filter ClientAppUsed = "Other clients" and "Exchange ActiveSync" — see who's still using Legacy Auth before blocking.

CA-003 Block Unknown/Unsupported Device Platforms

MediumP1

▾

Block access from devices whose platform cannot be identified (Linux, unmanaged ChromeOS, etc.).

Setting	Value
Users	All users
Cloud Apps	All cloud apps
Conditions → Device Platforms	Select platforms to ALLOW: macOS, iOS, Android, Windows — everything else (Linux, "Other") is blocked
Grant	Block access

💻 Device Policies

CA-010 Require Compliant Device — Office 365

HighP1

▾

Require an Intune-Compliant device for access to Office 365. Ensures only managed, security-compliant devices can reach email, Teams, and SharePoint.

Setting	Value
Users	All users — Exclude: BreakGlass
Cloud Apps	Office 365
Grant	Require device to be marked as compliant OR Require Hybrid Azure AD joined

⚠️

Intune Enrollment Required

Before enforcing, ensure all devices are enrolled in Intune and have an active Compliance Policy assigned.

CA-011 Require App Protection Policy — Mobile

HighP1

▾

Allow mobile access only through Intune-managed apps with App Protection Policy (MAM). Enables secure BYOD scenarios.

Setting	Value
Users	All users
Cloud Apps	Office 365
Conditions → Device Platforms	iOS, Android
Grant	Require approved client app AND Require app protection policy

📱 Application Policies

CA-015 Session Control — SharePoint External Users

MediumP1

▾

Restrict download/print/copy capabilities for external/guest users in SharePoint — via MCAS App Control.

Setting	Value
Users	All guest and external users
Cloud Apps	SharePoint Online
Session	Use Conditional Access App Control → Monitor only / Block downloads

CA-016 Session Frequency — Sensitive Apps

MediumP1

▾

Limit session length for sensitive applications — force re-authentication every X hours.

Setting	Value
Cloud Apps	Azure Portal, Exchange Admin, SharePoint Admin, Security portals
Session → Sign-in Frequency	1 hour (for admins), 8 hours (for all users)
Session → Persistent Browser	Never persistent

⚡ Risk-Based Policies (P2)

ℹ️

Requires Entra ID Protection (P2)

Risk-based policies require Microsoft Entra ID Protection — included in M365 E5, EMS E5, Entra ID P2.

CA-030 Block High Sign-in Risk

RequiredP2

▾

Block sign-ins with high risk — such as Impossible travel, Anonymous IP, Malware-linked IP.

Setting	Value
Users	All users — Exclude: BreakGlass
Cloud Apps	All cloud apps
Conditions → Sign-in Risk	High
Grant	Block access

CA-031 Require MFA — Medium Sign-in Risk

HighP2

▾

Require strong, phishing-resistant MFA (FIDO2 / Authenticator) for medium-risk sign-ins.

Setting	Value
Conditions → Sign-in Risk	Medium
Grant	Require MFA (Authentication Strength: Phishing-resistant MFA)

CA-032 Block High User Risk + Force Password Change

RequiredP2

▾

Account with high user risk (leaked credentials) — require password change via SSPR.

Setting	Value
Conditions → User Risk	High
Grant	Require password change + Require MFA

✅

SSPR Must Be Enabled

Self-Service Password Reset must be enabled so users can reset their password and unblock themselves without calling the helpdesk.

🛡️ Admin Policies

CA-020 Require Phishing-Resistant MFA — All Admins

RequiredP1

▾

Admins are the primary target of attacks. Require strong, phishing-resistant MFA (FIDO2, Windows Hello, Certificate-based).

Setting	Value
Users	Directory roles: Global Admin, Privileged Role Admin, Security Admin, Exchange Admin, SharePoint Admin, Compliance Admin, Billing Admin, Authentication Admin + all other privileged roles
Cloud Apps	All cloud apps
Grant	Require Authentication Strength: Phishing-resistant MFA

CA-021 Require Compliant Device — Admin Portals

HighP1

▾

Admins should only operate from managed, compliant devices. Privileged Access Workstations (PAW) is the ideal.

Setting	Value
Users	Directory roles (all privileged roles)
Cloud Apps	Microsoft Admin Portals (Azure Portal, M365 Admin, Entra)
Grant	Require Compliant Device OR Require Hybrid AD Joined

CA-022 Block Admin Access from Non-Corporate Locations

MediumP1

▾

Admins manage only from the corporate network (Trusted Location) — external access requires VPN first.

Setting	Value
Users	Directory roles
Cloud Apps	Microsoft Admin Portals
Conditions → Locations	All locations — Exclude: Trusted Locations (Corporate IPs)
Grant	Block access (outside Trusted Location)

🔒 Data Protection & Additional Policies

CA-040 Block Access from Blocked Countries

HighP1

▾

Block access from countries where you don't expect legitimate sign-ins.

Setting	Value
Users	All users
Cloud Apps	All cloud apps
Conditions → Locations	Named Location: Blocked Countries
Grant	Block access

CA-041 Require MFA — Azure Management

RequiredP1

▾

All access to Azure Portal, Azure CLI, PowerShell — requires MFA, even if CA-001 already covers it. Defense in depth.

Setting	Value
Cloud Apps	Microsoft Azure Management
Grant	Require MFA

CA-042 Block Device Code Flow

HighP1

▾

Device Code Flow can be exploited for token theft (Device Code Phishing). Block if there's no legitimate use case.

Setting	Value
Conditions → Authentication Flows	Device code flow
Grant	Block access

📊 KQL Queries — Monitoring & Analysis

Sign-ins Blocked by CA Policies

Sign-in Blocks by CA Policy

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == "53003" // CA block
| mv-expand ConditionalAccessPolicies
| extend
    PolicyName = tostring(ConditionalAccessPolicies.displayName),
    PolicyResult = tostring(ConditionalAccessPolicies.result)
| where PolicyResult == "failure"
| summarize BlockCount = count() by PolicyName, UserPrincipalName
| sort by BlockCount desc

Report-Only Analysis — What Would Have Been Blocked

Report-Only Would-Have-Blocked

SigninLogs
| where TimeGenerated > ago(14d)
| mv-expand ConditionalAccessPolicies
| extend
    PolicyName = tostring(ConditionalAccessPolicies.displayName),
    PolicyResult = tostring(ConditionalAccessPolicies.result)
| where PolicyResult == "reportOnlyFailure"
| summarize WouldBlock = count() by PolicyName, UserPrincipalName, AppDisplayName
| sort by WouldBlock desc

Legacy Authentication Usage

Legacy Auth — Who's Still Using It?

SigninLogs
| where TimeGenerated > ago(30d)
| where ClientAppUsed in ("Exchange ActiveSync", "IMAP4", "MAPI", "POP3", "SMTP", "Other clients")
| where ResultType == "0" // successful sign-ins only
| summarize Count = count(), LastSeen = max(TimeGenerated)
    by UserPrincipalName, ClientAppUsed, AppDisplayName
| sort by Count desc

MFA Failures — Brute Force Detection

MFA Failures per User

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType in ("50074", "50076", "500121") // MFA required/failed
| summarize Failures = count(), Locations = make_set(Location)
    by UserPrincipalName, IPAddress
| where Failures > 5
| sort by Failures desc

Risky Sign-ins

Sign-in Risk — High/Medium

SigninLogs
| where TimeGenerated > ago(7d)
| where RiskLevelDuringSignIn in ("high", "medium")
| project TimeGenerated, UserPrincipalName, RiskLevelDuringSignIn,
           RiskDetail, IPAddress, Location, AppDisplayName, ResultType
| sort by TimeGenerated desc

Policy Coverage Gaps — Sign-ins with No CA Policy Applied

No CA Policy Applied

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == "0"
| where array_length(ConditionalAccessPolicies) == 0
| where UserType == "Member"
| summarize Count = count() by UserPrincipalName, AppDisplayName
| sort by Count desc

✅ Conditional Access Checklist

Progress:

0 / 0

🏗️ Preparation

Created 2 Break Glass Accounts using *.onmicrosoft.com domainRequired
Created CA-BreakGlass-Exclude group and excluded it from every policyRequired
Configured Log Analytics alert for every Break Glass sign-inHigh
All new policies start in Report-Only mode for at least 7 daysRequired
Checked Sign-in Logs before blocking Legacy AuthenticationHigh
Configured Named Location for Corporate Office IPs
Configured Named Location for Blocked Countries
MFA Registration Policy enabled — all users registeredRequired

🔐 Baseline Policies

CA-001 — Require MFA All Users is EnabledRequired
CA-002 — Block Legacy Auth is EnabledRequired
CA-003 — Block Unknown Platforms is Enabled

💻 Device Policies

CA-010 — Require Compliant Device for Office 365High
CA-011 — App Protection Policy for Mobile
Intune Enrollment Profile configured for all platformsHigh

🛡️ Admin Policies

CA-020 — Phishing-Resistant MFA for all AdminsRequired
CA-021 — Compliant Device for Admin PortalsHigh
CA-022 — Restrict Admin Access from External Locations
All admins have FIDO2 / Windows Hello For BusinessHigh

⚡ Risk-Based (P2)

CA-030 — Block High Sign-in Risk is EnabledP2
CA-031 — MFA for Medium Sign-in Risk is EnabledP2
CA-032 — Password Change on High User Risk is EnabledP2
SSPR enabled for all usersP2

🔒 Additional

CA-040 — Block Blocked Countries is Enabled
CA-041 — Require MFA for Azure ManagementRequired
CA-042 — Block Device Code FlowHigh
All policy names follow the Naming Convention
KQL Queries configured in Log Analytics / Sentinel
What If tool tested before every new policy enforcement

🔐 Conditional Access

🎯 What is Conditional Access?

🏗️ Architecture — Request Flow

🧩 Policy Components

Assignments (Who)

Conditions

Grant Controls (What to require)

Session Controls

📜 License Requirements

🏷️ Naming Convention

⚠️ Break Glass Accounts

Setting Up Break Glass

📊 Report-Only Mode

Recommended Workflow

🧪 What If Tool

Where to Find It

📍 Named Locations

IP Ranges

Country Locations

🧑 Identity Policies

💻 Device Policies

📱 Application Policies

⚡ Risk-Based Policies (P2)

🛡️ Admin Policies

🔒 Data Protection & Additional Policies

📊 KQL Queries — Monitoring & Analysis

Sign-ins Blocked by CA Policies

Report-Only Analysis — What Would Have Been Blocked

Legacy Authentication Usage

MFA Failures — Brute Force Detection

Risky Sign-ins

Policy Coverage Gaps — Sign-ins with No CA Policy Applied

✅ Conditional Access Checklist

🏗️ Preparation

🔐 Baseline Policies

💻 Device Policies

🛡️ Admin Policies

⚡ Risk-Based (P2)

🔒 Additional

Accessibility Options