Conditional Access
What it is
Conditional Access (CA) is Microsoft Entra ID’s sign-in policy engine. It evaluates signals—such as the user, application, location, device, or detected risk—and applies an “if this, then that” decision. For example: “if an administrator accesses Azure management, require MFA.”
Why it exists
A single rule does not fit every sign-in. Conditional Access lets an organization add the right control when the context calls for it—such as blocking legacy authentication or requiring MFA for an administrative app—without granting any Azure resource permission.
Key ideas
- Assignments: target users, groups, workloads, cloud apps, and conditions such as locations or device state.
- Decisions: block access, or grant access while requiring a control such as MFA, an authentication strength, a compliant device, a hybrid-joined device, a password change, or terms of use.
- Session controls: can govern a successful session, for example sign-in frequency or app-enforced restrictions.
- First-factor timing: CA is evaluated after first-factor authentication. It is not a frontline defence against denial-of-service attacks.
- Safe rollout: use report-only mode and the What If tool, pilot with a small group, and preserve tested emergency-access accounts before enforcing a broad policy.
- Licensing: Conditional Access requires Microsoft Entra ID P1 (or an included eligible license); risk-based policies require Entra ID Protection/P2.
Northwind example
Northwind targets its Azure-management application with a policy: platform administrators must complete MFA. Maya first runs the policy in report-only mode and checks how it would affect the administrator group. The policy decides whether Maya can complete the sign-in; Azure RBAC still decides whether she may restart a particular VM after signing in.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/conditional-access/overview
Exam notes
- CA is a sign-in policy with assignments, conditions, and controls—not an Azure RBAC role.
- A broad policy without testing can lock out legitimate users or administrators.
Related
entraid · mfa · user-account · azure-ad-roles