Microsoft Learn

Understanding Microsoft Entra ID Conditional Access

Microsoft Entra ID Conditional Access is a powerful tool that allows you to enforce organizational policies for access to cloud apps and resources. It acts as a gatekeeper, ensuring that only authorized users can access specific applications and data under specific conditions.

What is Conditional Access?

Conditional Access policies are essentially if-then statements. If a condition is met, then access is granted or denied. These conditions can include:

• Users and groups: Who is the user trying to access the resource?
• Cloud apps or actions: What resource is the user trying to access?
• Conditions:
  • Device platform: Is the user on Windows, iOS, Android, etc.?
  • Location: Is the user accessing from a trusted IP address or a risky location?
  • Client applications: Is the user using a browser or a mobile app?
  • Sign-in risk: Has Microsoft Entra ID detected a potentially risky sign-in?
  • User risk: Has Microsoft Entra ID detected a potentially risky user account?
• Access controls: What actions should be enforced if the conditions are met?
  • Block access: Deny access to the application.
  • Grant access: Allow access, potentially with additional requirements.
    • Require multi-factor authentication (MFA): User must complete an MFA challenge.
    • Require device to be marked as compliant: Device must meet defined compliance policies (e.g., managed by Intune).
    • Require Microsoft Entra hybrid joined device: Device must be joined to both on-premises Active Directory and Microsoft Entra ID.
    • Require approved client application: Access must be from a specific, approved app.
    • Require app protection policy: Data must be protected by an app protection policy.
    • Require password change: User must change their password.

Key Benefits of Conditional Access

• Enhanced Security: By enforcing policies based on context, you can significantly reduce the risk of unauthorized access and data breaches.
• Improved User Experience: When users are accessing resources from trusted locations and devices, they may not need to go through MFA, leading to a smoother experience.
• Compliance: Helps organizations meet regulatory and compliance requirements by enforcing stricter access controls.
• Granular Control: Allows for fine-grained control over who can access what, and under what circumstances.

Common Use Cases

• Require MFA for all users: A baseline security measure.
• Block access from untrusted locations: Prevent access from outside your corporate network or known risky regions.
• Require compliant devices for accessing sensitive apps: Ensure that only managed and secure devices can connect to critical applications.
• Grant access to specific apps only when on a hybrid joined device: For highly sensitive resources.
• Block legacy authentication clients: Phishing-resistant modern authentication is preferred.

Creating a Conditional Access Policy

Policies are created and managed within the Microsoft Entra admin center:

1. Navigate to Microsoft Entra ID > Protection > Conditional Access.
2. Select New policy.
3. Configure the assignments (users, cloud apps, conditions) and the access controls (grant or block).

Conditional Access is a cornerstone of modern identity and access management in Microsoft Entra ID, providing a flexible and powerful way to secure your cloud resources.