Conditional Access conditions
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 4dd074c · +6 −16 lines · also on GitHub
⋯ 1 unchanged line
22
title: How to Use Conditions in Conditional Access Policies
33
description: Explore Conditional Access conditions, including user risk, sign-in risk, and insider risk, to secure your organization's resources with tailored policies.
44
ms.topic: concept-article
5
−ms.date: 03/24/2026
5
+ms.date: 04/01/2026
66
ms.reviewer: lhuangnorth, sandeo
77
---
88
# Conditional Access: Conditions
⋯ 136 unchanged lines
145145
146146
#### Why do I see a certificate prompt in the browser
147147
148
−On Windows 7, iOS, Android, and macOS devices are identified using a client certificate. This certificate is provisioned when the device is registered. When a user first signs in through the browser the user is prompted to select the certificate. The user must select this certificate before using the browser.
148
+On iOS, Android, and macOS devices are identified using a client certificate. This certificate is provisioned when the device is registered. When a user first signs in through the browser the user is prompted to select the certificate. The user must select this certificate before using the browser.
149149
150150
#### Chrome support
151151
⋯ 15 unchanged lines
167167
- Type: `REG_SZ (String)`
168168
- Data: `ppnbnpeolgkicgegkbkbjmhlideopiji;https://clients2.google.com/service/update2/crx`
169169
170
−For Chrome support in **Windows 8.1 and 7**, create the following registry key:
171
−
172
−- Path: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\AutoSelectCertificateForUrls`
173
−- Name: `1`
174
−- Type: `REG_SZ (String)`
175
−- Data: `{"pattern":"https://device.login.microsoftonline.com","filter":{"ISSUER":{"CN":"MS-Organization-Access"}}}`
176
−
177170
##### macOS
178171
179172
macOS devices using the Enterprise SSO plugin require the [Microsoft Single Sign On](https://chromewebstore.google.com/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji) extension to support SSO and device-based Conditional Access in Google Chrome.
⋯ 8 unchanged lines
188181
189182
| Client apps | Target Service | Platform |
190183
| --- | --- | --- |
191
−| Dynamics CRM app | Dynamics CRM | Windows 10, Windows 8.1, iOS, and Android |
184
+| Dynamics CRM app | Dynamics CRM | Windows 10, iOS, and Android |
192185
| Mail/Calendar/People app, Outlook 2016, Outlook 2013 (with modern authentication)| Exchange Online | Windows 10 |
193186
| MFA and location policy for apps. Device-based policies aren’t supported.| Any My Apps app service | Android and iOS |
194
−| Microsoft Teams Services - this client app controls all services that support Microsoft Teams and all its Client Apps - Windows Desktop, iOS, Android, WP, and web client | Microsoft Teams | Windows 10, Windows 8.1, Windows 7, iOS, Android, and macOS |
195
−| Office 2016 apps, Office 2013 (with modern authentication), [OneDrive sync client](/sharepoint/enable-conditional-access) | SharePoint | Windows 8.1, Windows 7 |
187
+| Microsoft Teams Services - this client app controls all services that support Microsoft Teams and all its Client Apps - Windows Desktop, iOS, Android, WP, and web client | Microsoft Teams | Windows 10, iOS, Android, and macOS |
196188
| Office 2016 apps, Universal Office apps, Office 2013 (with modern authentication), [OneDrive sync client](/sharepoint/enable-conditional-access) | SharePoint Online | Windows 10 |
197189
| Office 2016 (Word, Excel, PowerPoint, OneNote only). | SharePoint | macOS |
198190
| Office 2019| SharePoint | Windows 10, macOS |
⋯ 1 unchanged line
200192
| Office Yammer app | Yammer | Windows 10, iOS, Android |
201193
| Outlook 2019 | SharePoint | Windows 10, macOS |
202194
| Outlook 2016 (Office for macOS) | Exchange Online | macOS |
203
−| Outlook 2016, Outlook 2013 (with modern authentication), Skype for Business (with modern authentication) | Exchange Online | Windows 8.1, Windows 7 |
204195
| Outlook mobile app | Exchange Online | Android, iOS |
205
−| Power BI app | Power BI service | Windows 10, Windows 8.1, Windows 7, Android, and iOS |
206
−| Skype for Business | Exchange Online| Android, iOS |
207
−| Azure DevOps Services (formerly Visual Studio Team Services, or VSTS) app | Azure DevOps Services (formerly Visual Studio Team Services, or VSTS) | Windows 10, Windows 8.1, Windows 7, iOS, and Android |
196
+| Power BI app | Power BI service | Windows 10, Android, and iOS |
197
+| Azure DevOps Services (formerly Visual Studio Team Services, or VSTS) app | Azure DevOps Services (formerly Visual Studio Team Services, or VSTS) | Windows 10, iOS, and Android |
208198
209199
### Exchange ActiveSync clients
210200
⋯ 34 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.