Conditional Access
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5a3d207 · +36 −37 lines · also on GitHub
11
---
2
−title: What is Conditional Access in Microsoft Entra ID?
3
−description: Conditional Access is the Zero Trust policy engine at the heart of the new identity-driven control plane.
2
+title: "Microsoft Entra Conditional Access: Zero Trust Policy Engine"
3
+description: Explore Microsoft Entra Conditional Access, the Zero Trust policy engine that integrates signals to secure access to resources.
44
55
ms.service: entra-id
66
ms.subservice: conditional-access
77
ms.topic: overview
8
−ms.date: 07/01/2025
8
+ms.date: 09/23/2025
99
1010
ms.author: joflore
1111
author: MicrosoftGuyJFlo
⋯ 8 unchanged lines
2020
2121
Conditional Access policies at their simplest are if-then statements; **if** a user wants to access a resource, **then** they must complete an action. For example: If a user wants to access an application or service like Microsoft 365, then they must perform multifactor authentication to gain access.
2222
23
−Administrators are faced with two primary goals:
23
+Admins are faced with two primary goals:
2424
2525
- Empower users to be productive wherever and whenever
2626
- Protect the organization's assets
⋯ 5 unchanged lines
3232
3333
## Common signals
3434
35
−Conditional Access takes signals from various sources into account when making access decisions.
35
+Conditional Access uses signals from various sources to make access decisions.
3636
3737
:::image type="content" source="media/overview/conditional-access-central-policy-engine-zero-trust.png" alt-text="Diagram that shows Conditional Access as the Zero Trust policy engine aggregating signals from various sources.":::
3838
3939
These signals include:
4040
4141
- User or group membership
42
− - Policies can be targeted to specific users and groups giving administrators fine-grained control over access.
42
+ - Policies can be targeted to specific users and groups giving admins fine-grained control over access.
4343
- IP Location information
4444
- Organizations can create trusted IP address ranges that can be used when making policy decisions.
45
− - Administrators can specify entire countries or regions IP ranges to block or allow traffic from.
45
+ - Admins can specify entire countries or regions IP ranges to block or allow traffic from.
4646
- Device
4747
- Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.
4848
- Use filters for devices to target policies to specific devices like privileged access workstations.
4949
- Application
50
− - Users attempting to access specific applications can trigger different Conditional Access policies.
50
+ - Trigger different Conditional Access policies when users attempt to access specific applications.
5151
- Real-time and calculated risk detection
52
− - Signals integration with [Microsoft Entra ID Protection](~/id-protection/overview-identity-protection.md) lets Conditional Access policies identify and remediate risky users and sign-in behavior.
52
+ - Integrate signals from [Microsoft Entra ID Protection](~/id-protection/overview-identity-protection.md) to identify and remediate risky users and sign-in behavior.
5353
- [Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps)
54
− - Lets user application access and sessions be monitored and controlled in real time. This integration increases visibility and control over access to and activities done within your cloud environment.
54
+ - Monitor and control user application access and sessions in real time. This integration improves visibility and control over access and activities in your cloud environment.
5555
5656
## Common decisions
5757
58
−- Block access
59
− - Most restrictive decision
60
−- Grant access
61
−- Less restrictive decision that can require one or more of the following options:
62
− - Require multifactor authentication
63
− - Require authentication strength
64
− - Require device to be marked as compliant
65
− - Require Microsoft Entra hybrid joined device
66
− - Require approved client app
67
− - Require app protection policy
68
− - Require password change
69
− - Require terms of use
58
+- Block access.
59
+ - This is the most restrictive decision.
60
+- Grant access.
61
+- A less restrictive decision that might require one or more of the following options:
62
+ - Require multifactor authentication.
63
+ - Require authentication strength.
64
+ - Require the device to be marked as compliant.
65
+ - Require a Microsoft Entra hybrid joined device.
66
+ - Require an approved client app.
67
+ - Require an app protection policy.
68
+ - Require a password change.
69
+ - Require terms of use.
7070
7171
## Commonly applied policies
7272
⋯ 7 unchanged lines
8080
- Blocking risky sign-in behaviors
8181
- Requiring organization-managed devices for specific applications
8282
83
−Admins can create policies from scratch or start from a template policy in the portal or using the Microsoft Graph API.
83
+Admins can create policies from scratch or start with a template policy in the portal or by using the Microsoft Graph API.
8484
85
−## Administrator experience
85
+<a name='admin-experience'></a>
8686
87
−Administrators with the [Conditional Access Administrator](~/identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role can manage policies.
87
+## Admin experience
8888
89
−Conditional Access is found in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access**.
89
+Admins with the [Conditional Access Administrator](~/identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role can manage policies.
9090
91
+You can find Conditional Access in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access**.
92
+
9193
:::image type="content" source="media/overview/conditional-access-overview.png" alt-text="Screenshot of the Conditional Access overview page." lightbox="media/overview/conditional-access-overview.png":::
9294
93
−- The **Overview** page provides a summary of policy state, users, devices, and applications, as well as general and security alerts with suggestions.
94
−- The **Coverage** page provides a synopsis of applications with and without Conditional Access policy coverage over the last seven days.
95
−- The **Monitoring** page allows administrators to see a graph of sign-ins that can be filtered to see potential gaps in policy coverage.
95
+- The **Overview** page shows a summary of policy state, users, devices, and applications, along with general and security alerts with suggestions.
96
+- The **Coverage** page shows a summary of applications with and without Conditional Access policy coverage over the last seven days.
97
+- The **Monitoring** page allows admins to see a graph of sign-ins that can be filtered to see potential gaps in policy coverage.
9698
97
−Conditional Access policies on the **Policies** page can be filtered by administrators based on items like the actor, target resource, condition, control applied, state, or date. This filtering ability lets administrators find specific policies based on their configuration quickly.
99
+Conditional Access policies on the **Policies** page can be filtered by admins based on items like the actor, target resource, condition, control applied, state, or date. This filtering ability lets admins find specific policies based on their configuration quickly.
98100
99101
### Conditional Access optimization agent
100102
101
−The [Conditional Access optimization agent](agent-optimization.md) (preview) with Microsoft Security Copilot recommends new policies and changes to existing policies based on Zero Trust principles and Microsoft best practices. With one click, you can apply the suggestion to automatically update or create a Conditional Access policy. The agent requires at least the Microsoft Entra ID P1 license and [security compute units (SCU)](/copilot/security/manage-usage).
103
+The [Conditional Access optimization agent](agent-optimization.md) (preview) with Microsoft Security Copilot suggests new policies and changes to existing ones based on Zero Trust principles and Microsoft best practices. With one click, apply the suggestion to automatically update or create a Conditional Access policy. The agent needs at least the Microsoft Entra ID P1 license and [security compute units (SCU)](/copilot/security/manage-usage).
102104
103105
## License requirements
104106
105107
[!INCLUDE [Active Directory P1 license](~/includes/entra-p1-license.md)]
106108
107
−Customers with [Microsoft 365 Business Premium licenses](/office365/servicedescriptions/office-365-service-descriptions-technet-library) also have access to Conditional Access features.
108
−
109
−Risk-based policies require access to [Microsoft Entra ID Protection](~/id-protection/overview-identity-protection.md), which requires P2 licenses.
109
+Customers with [Microsoft 365 Business Premium licenses](/office365/servicedescriptions/office-365-service-descriptions-technet-library) can also use Conditional Access features.
110110
111
−Other products and features that interact with Conditional Access policies require appropriate licensing for those products and features.
111
+Other products and features that interact with Conditional Access policies require appropriate licensing for those products and features. This includes Microsoft Entra Workload ID, Microsoft Entra ID Protection, and features like Microsoft Purview.
112112
113
−When licenses required for Conditional Access expire, policies aren't automatically disabled or deleted. This lets customers migrate away from Conditional Access policies without a sudden change in their security posture. Remaining policies can be viewed and deleted, but no longer updated.
113
+When the licenses required for Conditional Access expire, policies aren't automatically disabled or deleted. This lets customers migrate away from Conditional Access policies without a sudden change in their security posture. You can view and delete remaining policies, but you can't update them.
114114
115115
[Security defaults](~/fundamentals/security-defaults.md) help protect against identity-related attacks and are available for all customers.
116116
⋯ 1 unchanged line
118118
119119
## Next steps
120120
121
−- [Building a Conditional Access policy piece by piece](concept-conditional-access-policies.md)
122121
- [Plan your Conditional Access deployment](plan-conditional-access.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.