Conditional Access Policies

Conditional Access is the decision engine at the heart of Microsoft's zero-trust strategy. It evaluates signals during sign-in — such as user identity, device state, location, and application — and enforces policies that grant, block, or require additional verification before allowing access.

---

What Is Conditional Access?

Conditional Access policies are if-then rules:

• If a set of conditions is met (who, where, what, when)
• Then apply a set of access controls (allow, block, require MFA, etc.)

For example: "If a user is signing in from outside the corporate network, then require multi-factor authentication."

Conditional Access requires Microsoft Entra ID P1 or higher.

---

How Conditional Access Works

The evaluation flow:

1. A user attempts to sign in to a cloud application
2. Entra ID authenticates the user (first factor)
3. The Conditional Access engine evaluates all policies that apply
4. If multiple policies apply, all policies must be satisfied (AND logic)
5. The strictest access controls are enforced

User Sign-In
  |
  v
Authentication (First Factor)
  |
  v
Conditional Access Engine
  |-- Evaluate Conditions (signals)
  |-- Match Policies
  |-- Apply Controls
  |
  v
Access Granted / Blocked / MFA Required

---