Conditional Access grant controls
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 61495a5 · +17 −1 lines · also on GitHub
⋯ 1 unchanged line
22
title: How to Configure Grant Controls in Microsoft Entra
33
description: Learn how to configure grant controls in Microsoft Entra Conditional Access policies to secure access to your organization's resources effectively.
44
ms.topic: concept-article
5
−ms.date: 03/24/2026
5
+ms.date: 06/02/2026
6
+ai-usage: ai-assisted
67
ms.reviewer: lhuangnorth, jogro
78
ms.custom:
89
- sfi-image-nochange
⋯ 35 unchanged lines
4445
4546
By default, Conditional Access requires all selected controls.
4647
48
+### Grant controls for agent users (Preview)
49
+
50
+When a policy targets agents acting as users, the available grant behavior differs from user and group scenarios:
51
+
52
+- **Block access**
53
+- **Grant access** with **Require device to be marked as compliant**
54
+
55
+Use **Require device to be marked as compliant** when agent user sessions run on managed endpoints that provide device compliance signals.
56
+
57
+Agent identities don't support grant controls and only support **Block access**. For targeting and condition guidance, see [Target agent identities in Conditional Access policies](howto-target-agent-identities.md).
58
+
4759
### Require multifactor authentication
4860
4961
Selecting this checkbox requires users to perform Microsoft Entra multifactor authentication. You can find more information about deploying Microsoft Entra multifactor authentication in [Planning a cloud-based Microsoft Entra multifactor authentication deployment](~/identity/authentication/howto-mfa-getstarted.md).
⋯ 16 unchanged lines
6678
6779
- Only supports Windows 10+, iOS, Android, macOS, and Linux Ubuntu devices registered with Microsoft Entra ID and enrolled with Intune.
6880
- Microsoft Edge in InPrivate mode on Windows is considered as a noncompliant device.
81
+
82
+For agent user scenarios, this control only applies when the agent user session runs from an endpoint where device state is available. Agent user sessions that run directly in cloud infrastructure might not provide device compliance signals.
83
+
84
+For policies that target agent users, combine this control with scoping conditions so the policy applies only to endpoint-based sessions. For details, see [Target agent identities in Conditional Access policies](howto-target-agent-identities.md).
6985
7086
> [!NOTE]
7187
> On Windows, iOS, Android, macOS, and some non-Microsoft web browsers, Microsoft Entra ID identifies the device by using a client certificate that is provisioned when the device is registered with Microsoft Entra ID. When a user first signs in through the browser, the user is prompted to select the certificate. The user must select this certificate before they can continue to use the browser.
⋯ 165 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:16 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.