Conditional Access conditions
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 4b77a1c · +18 −2 lines · also on GitHub
11
---
22
title: How to Use Conditions in Conditional Access Policies
3
−description: Explore Conditional Access conditions, including user risk, sign-in risk, and insider risk, to secure your organization's resources with tailored policies.
3
+description: Explore Conditional Access conditions, including risk, device, network, and agent execution environment signals, to secure your organization's resources with tailored policies.
44
ms.topic: concept-article
5
−ms.date: 04/01/2026
5
+ms.date: 06/02/2026
66
ms.reviewer: lhuangnorth, sandeo
7
+ai-usage: ai-assisted
78
---
89
# Conditional Access: Conditions
910
⋯ 8 unchanged lines
1819
When users access a sensitive application, admins might consider multiple conditions in their access decisions, such as:
1920
2021
- Risk information from Microsoft Entra ID Protection
22
+- Agent execution environment
2123
- Network location
2224
- Device information
2325
⋯ 23 unchanged lines
4749
4850
For more information, see [configure and enable an insider risk-based policy](policy-risk-based-insider-block.md).
4951
52
+## Agent execution environments (Preview)
53
+
54
+Use the **Agent execution environments** condition to scope a Conditional Access policy to agents' user account sessions initiated from endpoints. This condition helps you avoid applying endpoint-dependent controls to agents that run directly in the cloud and don't have a device to evaluate.
55
+
56
+When a policy uses this condition, agents that aren't running on a device are excluded from evaluation. Use this condition with other endpoint-based conditions, such as **Device platforms**, **Filter for devices**, and **Network**, when you want to enforce controls only for agents running on managed endpoints.
57
+
58
+For more information about how this condition applies to agents, see [Conditional Access for agent identities](agent-id.md#device-and-network-protections-for-agents-on-endpoints).
59
+
5060
## Device platforms
5161
5262
Conditional Access identifies the device platform using information provided by the device, such as user agent strings. Because user agent strings can be modified, this information isn't verified. Use device platform with Microsoft Intune device compliance policies or as part of a block statement. By default, it applies to all device platforms.
5363
64
+For agents' user accounts, this condition applies only when the agent session is initiated from an endpoint. Use it with the **Agent execution environments** condition to avoid targeting agents that run directly in cloud infrastructure.
65
+
5466
Conditional Access supports these device platforms:
5567
5668
- Android
⋯ 13 unchanged lines
7082
7183
[The locations condition has moved.](concept-assignment-network.md)
7284
85
+For agents' user accounts, the **Network** condition applies only to agents running on endpoints that provide the required network signal, such as a device with a [Global Secure Access](/entra/global-secure-access/overview-what-is-global-secure-access) client.
86
+
7387
## Client apps
7488
7589
By default, all newly created Conditional Access policies apply to all client app types even if the client apps condition isn’t configured.
⋯ 149 unchanged lines
225239
## Filter for devices
226240
227241
When admins configure filter for devices as a condition, they can include or exclude devices based on a filter using a rule expression on device properties. You can author the rule expression for filter for devices using the rule builder or rule syntax. This process is similar to the one used for rules for dynamic membership groups. For more information, see [Conditional Access: Filter for devices](concept-condition-filters-for-devices.md).
242
+
243
+For agents' user accounts, this condition applies only when the agent session is initiated from an endpoint. Use it with the **Agent execution environments** condition when you need to target specific approved devices for agents running on endpoints.
228244
229245
## Authentication flows (preview)
230246
⋯ 6 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.