Conditional Access

What Conditional Access means in practice

Conditional Access is where Zero Trust stops being a diagram and becomes enforceable. Authentication proves who a person is; conditional access decides whether that person, on that device, from that location, may reach that application right now. It is the control point Microsoft 365 security design revolves around.

A policy has conditions and controls. Conditions include the user or group, the target application, the device platform and compliance state, the client application type, the network location, and the sign-in and user risk levels calculated by Entra ID Protection. Controls include requiring multi-factor authentication, requiring a compliant or hybrid-joined device, requiring an approved client application, forcing a session policy such as browser-only access with no download, or blocking outright.

A workable baseline for most organisations looks like this: block legacy authentication, require MFA for all users, require compliant devices for access to email and files, apply stricter controls to administrative roles, and restrict or challenge sign-ins from countries where the organisation has no staff. Risk-based policies come later, once there is enough telemetry to tune them without generating false lockouts.

Two operational details matter more than the policy list itself. First, break-glass accounts: at least two cloud-only global administrator accounts excluded from conditional access, with long random credentials held securely and monitored for use. Without them, a misconfigured policy can lock an organisation out of its own tenant. Second, report-only mode: every new policy should run in report-only for long enough to see what it would have blocked before it is enforced.

Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5. Risk-based conditional access requires P2, included in E5. Licensing is frequently the reason a security design gets cut back, so it is worth checking entitlement before designing the policy set.