Conditional Access grant controls

This page's changes and edits · All guidance changes

Microsoft's edit · 23 Sep 2025 18:29 UTC

[Conditional Access] Core docs freshness pass

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5a3d207 · +5 −5 lines · also on GitHub

⋯ 31 unchanged lines

3232

3333 ## Grant access

3434

35 −Administrators can choose to enforce one or more controls when granting access. These controls include the following options:

35 +Admins can choose to enforce one or more controls when granting access. These controls include the following options:

3636

3737 - [Require multifactor authentication (Microsoft Entra multifactor authentication)](~/identity/authentication/concept-mfa-howitworks.md)

3838 - [Require authentication strength](#require-authentication-strength)

⋯ 3 unchanged lines

4242 - [Require app protection policy](./policy-all-users-device-compliance.md)

4343 - [Require password change](#require-password-change)

4444

45 −When administrators choose to combine these options, they can use the following methods:

45 +When admins choose to combine these options, they can use the following methods:

4646

4747 - Require all the selected controls (control *and* control)

4848 - Require one of the selected controls (control *or* control)

⋯ 8 unchanged lines

5757

5858 ### Require authentication strength

5959

60 −Administrators can choose to require [specific authentication strengths](~/identity/authentication/concept-authentication-strengths.md) in their Conditional Access policies. These authentication strengths are defined in the **Microsoft Entra admin center** > **Entra ID** > **Authentication methods** > **Authentication strengths**. Administrators can choose to create their own or use the built-in versions.

60 +Admins can choose to require [specific authentication strengths](~/identity/authentication/concept-authentication-strengths.md) in their Conditional Access policies. These authentication strengths are defined in the **Microsoft Entra admin center** > **Entra ID** > **Authentication methods** > **Authentication strengths**. Admins can choose to create their own or use the built-in versions.

6161

6262 ### Require device to be marked as compliant

6363

⋯ 129 unchanged lines

193193

194194 ### Require password change

195195

196 −When user risk is detected, administrators can employ the user risk policy conditions to have the user securely change a password by using Microsoft Entra self-service password reset. Users can perform a self-service password reset to self-remediate. This process closes the user risk event to prevent unnecessary alerts for administrators.

196 +When user risk is detected, admins can employ the user risk policy conditions to have the user securely change a password by using Microsoft Entra self-service password reset. Users can perform a self-service password reset to self-remediate. This process closes the user risk event to prevent unnecessary alerts for admins.

197197

198198 When a user is prompted to change a password, they're first required to complete multifactor authentication. Make sure all users register for multifactor authentication, so they're prepared in case risk is detected for their account.

199199

⋯ 8 unchanged lines

208208

209209 ### Terms of use

210210

211 −If your organization created terms of use, other options might be visible under grant controls. These options allow administrators to require acknowledgment of terms of use as a condition of accessing the resources that the policy protects. You can find more information about terms of use in [Microsoft Entra terms of use](terms-of-use.md).

211 +If your organization created terms of use, other options might be visible under grant controls. These options allow admins to require acknowledgment of terms of use as a condition of accessing the resources that the policy protects. You can find more information about terms of use in [Microsoft Entra terms of use](terms-of-use.md).

212212

213213 ## Multiple grant controls

214214

⋯ 19 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:16 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.