Conditional Access
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6d9d6da · +35 −35 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.service: entra-id
66
ms.subservice: conditional-access
77
ms.topic: overview
8
−ms.date: 09/23/2025
8
+ms.date: 11/05/2025
99
1010
ms.author: joflore
1111
author: MicrosoftGuyJFlo
⋯ 6 unchanged lines
1818
1919
:::image type="content" source="media/common-conditional-access-media/conditional-access-signal-decision-enforcement.png" alt-text="Diagram showing concept of Conditional Access signals plus decision to enforce organizational policy." lightbox="media/common-conditional-access-media/conditional-access-signal-decision-enforcement.png":::
2020
21
−Conditional Access policies at their simplest are if-then statements; **if** a user wants to access a resource, **then** they must complete an action. For example: If a user wants to access an application or service like Microsoft 365, then they must perform multifactor authentication to gain access.
21
+Conditional Access policies at their simplest are if-then statements: **if** a user wants to access a resource, **then** they must complete an action. For example: If a user wants to access an application or service like Microsoft 365, then they must perform multifactor authentication to gain access.
2222
2323
Admins are faced with two primary goals:
2424
2525
- Empower users to be productive wherever and whenever
2626
- Protect the organization's assets
2727
28
−Use Conditional Access policies to apply the right access controls when needed to keep your organization secure.
28
+Use Conditional Access policies to apply the right access controls when needed to keep your organization secure and don't interfere with productivity.
2929
3030
> [!IMPORTANT]
31
−> Conditional Access policies are enforced after first-factor authentication is completed. Conditional Access isn't intended to be an organization's frontline of defense for scenarios like denial-of-service (DoS) attacks, but it can use signals from these events to determine access.
31
+> Conditional Access policies are enforced after first-factor authentication is completed. Conditional Access isn't intended to be an organization's frontline defense for scenarios like denial-of-service (DoS) attacks, but it can use signals from these events to determine access.
3232
3333
## Common signals
3434
⋯ 1 unchanged line
3636
3737
:::image type="content" source="media/overview/conditional-access-central-policy-engine-zero-trust.png" alt-text="Diagram that shows Conditional Access as the Zero Trust policy engine aggregating signals from various sources.":::
3838
39
−These signals include:
39
+Some of these signals include:
4040
41
−- User or group membership
42
− - Policies can be targeted to specific users and groups giving admins fine-grained control over access.
43
−- IP Location information
44
− - Organizations can create trusted IP address ranges that can be used when making policy decisions.
45
− - Admins can specify entire countries or regions IP ranges to block or allow traffic from.
46
−- Device
41
+- **User, group, or agent**
42
+ - Policies can be targeted to specific users, groups, and agents giving admins fine-grained control over access.
43
+ - Support for agent identities and agent users extends Zero Trust principles to AI workloads.
44
+- **IP location information**
45
+ - Organizations can create IP address ranges that can be used when making policy decisions.
46
+ - Admins can specify entire countries' or regions' IP ranges to block or allow traffic from.
47
+- **Device**
4748
- Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.
4849
- Use filters for devices to target policies to specific devices like privileged access workstations.
49
−- Application
50
+- **Application**
5051
- Trigger different Conditional Access policies when users attempt to access specific applications.
51
−- Real-time and calculated risk detection
52
− - Integrate signals from [Microsoft Entra ID Protection](~/id-protection/overview-identity-protection.md) to identify and remediate risky users and sign-in behavior.
53
−- [Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps)
54
− - Monitor and control user application access and sessions in real time. This integration improves visibility and control over access and activities in your cloud environment.
52
+ - Apply policies to traditional cloud apps, on-premises applications, and agent resources.
53
+- **Real-time and calculated risk detection**
54
+ - Integrates signals from [Microsoft Entra ID Protection](~/id-protection/overview-identity-protection.md) to identify and remediate risky users, sign-in behavior, and agent activities.
55
+- **[Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps)**
56
+ - Monitors and controls user application access and sessions in real time. This integration improves visibility and control over access and activities in your cloud environment.
5557
5658
## Common decisions
5759
5860
- Block access is the most restrictive decision.
59
−- Grant access.
61
+- Grant access
6062
- A less restrictive decision that might require one or more of the following options:
61
− - Require multifactor authentication.
62
− - Require authentication strength.
63
− - Require the device to be marked as compliant.
64
− - Require a Microsoft Entra hybrid joined device.
65
− - Require an approved client app.
66
− - Require an app protection policy.
67
− - Require a password change.
68
− - Require terms of use.
63
+ - Require multifactor authentication
64
+ - Require authentication strength
65
+ - Require the device to be marked as compliant
66
+ - Require a Microsoft Entra hybrid joined device
67
+ - Require an approved client app
68
+ - Require an app protection policy
69
+ - Require a password change
70
+ - Require terms of use
6971
7072
## Commonly applied policies
7173
⋯ 1 unchanged line
7375
7476
- Requiring multifactor authentication for users with administrative roles
7577
- Requiring multifactor authentication for Azure management tasks
76
−- Blocking sign-ins for users attempting to use legacy authentication protocols
78
+- Blocking sign-ins for users who try to use legacy authentication protocols
7779
- Requiring trusted locations for security information registration
7880
- Blocking or granting access from specific locations
7981
- Blocking risky sign-in behaviors
⋯ 5 unchanged lines
8587
8688
## Admin experience
8789
88
−Admins with the [Conditional Access Administrator](~/identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role can manage policies.
89
−
90
−You can find Conditional Access in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access**.
90
+Admins with at least the [Security Reader](~/identity/role-based-access-control/permissions-reference.md#security-reader) role can find Conditional Access in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access**.
9191
9292
:::image type="content" source="media/overview/conditional-access-overview.png" alt-text="Screenshot of the Conditional Access overview page." lightbox="media/overview/conditional-access-overview.png":::
9393
94
−- The **Overview** page shows a summary of policy state, users, devices, and applications, along with general and security alerts with suggestions.
95
−- The **Coverage** page shows a summary of applications with and without Conditional Access policy coverage over the last seven days.
96
−- The **Monitoring** page allows admins to see a graph of sign-ins that can be filtered to see potential gaps in policy coverage.
94
+- The **Overview** page shows a summary of policy state, agents, users, devices, and applications, along with general and security alerts with suggestions.
95
+- The **Coverage** page shows a summary of applications with and without Conditional Access policy coverage over the past seven days.
96
+- The **Monitoring** page lets admins see a graph of sign-ins that can be filtered to see potential gaps in policy coverage.
9797
98
−Conditional Access policies on the **Policies** page can be filtered by admins based on items like the actor, target resource, condition, control applied, state, or date. This filtering ability lets admins find specific policies based on their configuration quickly.
98
+On the **Policies** page, admins can filter Conditional Access policies based on items like the actor, target resource, condition, control applied, state, or date. This filtering lets admins quickly find specific policies based on their configuration.
9999
100100
### Conditional Access optimization agent
101101
⋯ 5 unchanged lines
107107
108108
Customers with [Microsoft 365 Business Premium licenses](/office365/servicedescriptions/office-365-service-descriptions-technet-library) can also use Conditional Access features.
109109
110
−Other products and features that interact with Conditional Access policies require appropriate licensing for those products and features. This includes Microsoft Entra Workload ID, Microsoft Entra ID Protection, and Microsoft Purview.
110
+Other products and features that interact with Conditional Access policies require appropriate licensing for those products and features, including Microsoft Entra Workload ID, Microsoft Entra ID Protection, and Microsoft Purview.
111111
112112
When the licenses required for Conditional Access expire, policies aren't automatically disabled or deleted. This graceful state lets customers migrate away from Conditional Access policies without a sudden change in their security posture. You can view and delete remaining policies, but you can't update them.
113113
⋯ 3 unchanged lines
117117
118118
## Next steps
119119
120
−- [Plan your Conditional Access deployment](plan-conditional-access.md)
120
+[Plan your Conditional Access deployment](plan-conditional-access.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:49 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.