Identity · Authorization
Conditional Access
Policy that evaluates signals about the user, device, application, location and risk at sign in, then grants, blocks or constrains access.
AdvancedMicrosoftUpdated 2026-09-01
Overview
Conditional Access is the practical engine of Zero Trust in a Microsoft estate. Each policy is an if/then statement: given these users, applications and conditions, require these controls, MFA, compliant device, approved client app, sign in frequency, or block outright.
Because policies combine, design discipline matters more than policy count. A small set of well named, deliberately layered policies is far more maintainable and auditable than dozens of overlapping ones.
How it works
- 01Assignments select users and groups, target resources, and conditions such as device platform, client app, location, risk level and authentication context.
- 02Access controls either grant with requirements or block. All grant requirements in a policy must be satisfied unless 'require one of the selected controls' is chosen.
- 03Session controls apply after grant: app enforced restrictions, Defender for Cloud Apps session proxy, sign in frequency and persistent browser behaviour.
- 04Every applicable policy is evaluated, and any block wins over any grant.
Design considerations
- Maintain excluded break glass accounts with long unique credentials, FIDO2 keys where possible, and dedicated alerting on their use.
- Deploy new policies in report only mode, review the impact using the what if tool and sign in logs, then enforce with a defined rollback.
- Cover the whole surface: users, workload identities, device registration, and administrative portals.
- Document intent for each policy, auditors and future administrators cannot infer it from the name alone.
Security considerations
- Require phishing resistant MFA for privileged roles and for access to administrative portals.
- Require compliant or hybrid joined devices for access to sensitive data rather than relying on network location.
- Block legacy authentication and unsupported clients that cannot honour policy.
- Alert on any change to Conditional Access policy; tampering is a high signal indicator of compromise.
Common misconfigurations
- Locking every administrator out with an untested policy and no break glass path.
- Using trusted IP ranges as a blanket MFA exemption, recreating implicit network trust.
- Leaving report only policies unmonitored so they never take effect.