Conditional Access is the policy engine in Microsoft Entra ID that decides whether a sign-in is allowed, blocked or allowed only with extra controls such as multifactor authentication or a compliant device. Each policy combines signals (who the user is, what app they are opening, the device, location and risk) with decisions (block, grant with requirements, or limit the session). It is the core of a Zero Trust approach for Microsoft 365 and Azure.
Key Takeaways
- Conditional Access policies follow an “if this, then that” model: assignments plus access controls.
- Conditional Access requires Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5); risk-based policies need P2.
- Always exclude break-glass emergency accounts and test in report-only mode first.
- Start with MFA for all users, blocking legacy authentication and protecting admin roles.
- Device compliance from Intune makes policies far stronger than MFA alone.
How Conditional Access Works
| Component | Examples |
|---|---|
| Users and groups | All users, admins, guests, specific departments |
| Target resources | All cloud apps, Exchange Online, SharePoint, Azure management |
| Conditions | Location, device platform, client app, sign-in risk, user risk |
| Grant controls | Require MFA, compliant device, hybrid joined device, approved app, authentication strength |
| Session controls | Sign-in frequency, persistent browser, app-enforced restrictions |
10 Essential Conditional Access Policies
- Require MFA for all users for all cloud apps.
- Require phishing-resistant MFA for administrators using authentication strengths.
- Block legacy authentication protocols that cannot do MFA.
- Require MFA for Azure management (portal, CLI, PowerShell).
- Require compliant or hybrid joined devices for access to corporate data.
- Require approved apps and app protection on iOS and Android.
- Block access from countries where you do not operate.
- Require MFA for risky sign-ins (Entra ID P2).
- Require password change for high-risk users (Entra ID P2).
- Limit guest access with MFA and sign-in frequency.
Best Practices for a Safe Rollout
- Create at least two cloud-only emergency access (break-glass) accounts and exclude them from policies.
- Use report-only mode and the What If tool before enforcing.
- Name policies consistently, for example “CA01-AllUsers-RequireMFA”.
- Use groups for exclusions and review them regularly.
- Monitor sign-in logs and Conditional Access insights workbooks.
- Combine with privileged access management for admin roles.
Common Mistakes
- Locking out all admins by not excluding break-glass accounts.
- Leaving legacy authentication open for “just one” app.
- Large, unmanaged exclusion lists that turn into permanent bypasses.
- Relying on trusted IP locations instead of device and identity signals.
Conditional Access and Zero Trust
Conditional Access is where Zero Trust principles become enforceable: verify explicitly, use least privilege and assume breach. It works best alongside Entra ID security hardening, device compliance from Intune and continuous monitoring with Defender XDR.
Migrating to Microsoft 365? Configure these policies during the move, as covered in our Google Workspace to Microsoft 365 checklist.
How Skytech Enterprise Helps
Our Conditional Access and MFA service designs, tests and deploys policies without disrupting users, for organizations across the USA and UAE. Request a Conditional Access review.
Frequently Asked Questions
What license do I need for Conditional Access?
Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5. Risk-based policies require Entra ID P2, included in E5.
What is the difference between security defaults and Conditional Access?
Security defaults are a free, fixed set of protections such as MFA registration and blocking legacy authentication. Conditional Access offers granular, customizable policies and is recommended for most businesses.
What is report-only mode?
Report-only mode evaluates a policy and logs what would have happened without enforcing it, so you can check impact before turning the policy on.
What is a break-glass account?
A break-glass account is a highly protected emergency administrator account excluded from Conditional Access policies, used only if normal admin access fails.
Can Conditional Access block access from specific countries?
Yes. Named locations let you block or restrict sign-ins from countries where your organization does not operate.
Does Conditional Access replace MFA?
No. Conditional Access decides when MFA and other controls are required, making MFA smarter and more targeted.