Conditional Access grant controls
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6ff1412 · +18 −13 lines · also on GitHub
11
---
2
−title: Grant controls in Conditional Access policy
3
−description: Grant controls in a Microsoft Entra Conditional Access policy.
2
+title: How to Configure Grant Controls in Microsoft Entra
3
+description: Learn how to configure grant controls in Microsoft Entra Conditional Access policies to secure access to your organization's resources effectively.
44
ms.service: entra-id
55
ms.subservice: conditional-access
66
ms.topic: article
7
−ms.date: 06/24/2024
7
+ms.date: 08/28/2025
88
ms.author: joflore
99
author: MicrosoftGuyJFlo
1010
manager: dougeby
1111
ms.reviewer: lhuangnorth, jogro
12
−ms.custom: sfi-image-nochange
12
+ms.custom:
13
+ - sfi-image-nochange
14
+ - ai-gen-docs-bap
15
+ - ai-gen-title
16
+ - ai-seo-date:08/28/2025
17
+ - ai-gen-description
1318
---
1419
# Conditional Access: Grant
1520
16
−Within a Conditional Access policy, an administrator can use access controls to grant or block access to resources.
21
+In a Conditional Access policy, an admin can use access controls to grant or block access to resources.
1722
18
−:::image type="content" source="media/concept-conditional-access-grant/conditional-access-grant.png" alt-text="Screenshot of a Conditional Access policy with a grant control that requires multifactor authentication." lightbox="media/concept-conditional-access-grant/conditional-access-grant.png":::
23
+:::image type="content" source="media/concept-conditional-access-grant/conditional-access-grant.png" alt-text="Screenshot of a Conditional Access policy that shows a grant control requiring phishing-resistant multifactor authentication." lightbox="media/concept-conditional-access-grant/conditional-access-grant.png":::
1924
2025
## Block access
2126
22
−The control for blocking access considers any assignments and prevents access based on the Conditional Access policy configuration.
27
+The control for blocking access evaluates assignments and prevents access based on the Conditional Access policy configuration.
2328
24
−**Block access** is a powerful control that you should apply with appropriate knowledge. Policies with block statements can have unintended side effects. Proper testing and validation are vital before you enable the control at scale. Administrators should use tools such as [Conditional Access report-only mode](concept-conditional-access-report-only.md) and [the What If tool in Conditional Access](what-if-tool.md) when making changes.
29
+**Block access** is a powerful control that requires careful application. Policies with block statements might cause unintended side effects. Proper testing and validation are essential before enabling the control at scale. Admins should use tools like [Conditional Access report-only mode](concept-conditional-access-report-only.md) and [the What If tool in Conditional Access](what-if-tool.md) when making changes.
2530
2631
## Grant access
2732
⋯ 149 unchanged lines
177182
- Notate for Intune
178183
- Provectus - Secure Contacts
179184
- Viva Engage (Android, iOS, and iPadOS)
180
−- Windows App (Android, iOS/iPadOS, and Edge on Windows)
185
+- Windows App (Android, iOS/iPadOS, and Microsoft Edge on Windows)
181186
182187
> [!NOTE]
183188
> Kaizala, Skype for Business, and Visio don't support the **Require app protection policy** grant. If you require these apps to work, use the **Require approved apps** grant exclusively. Using the "or" clause between the two grants won't work for these three applications.
⋯ 21 unchanged lines
205210
206211
## Multiple grant controls
207212
208
−When multiple grant controls are applied to a user, it's important to understand that Conditional Access policies follow a specific validation order by design. For example, if a user has two policies requiring multifactor authentication (MFA) and Terms of Use (ToU), Conditional Access first validates the user's MFA claim and then the ToU.
213
+When multiple grant controls apply to a user, understand that Conditional Access policies follow a specific validation order by design. For example, if a user has two policies requiring multifactor authentication (MFA) and Terms of Use (ToU), Conditional Access validates the user's MFA claim first, then the ToU.
209214
210
−- If a valid MFA claim isn't present in the token, you see an "interrupt" (pending MFA) and a failure for ToU in the logs, even if the ToU was already accepted in a previous sign-in.
211
−- Once multifactor authentication is completed, a second log entry appears, validating the ToU. If the user already accepted the ToU, you see success for both MFA and ToU.
215
+- If a valid MFA claim isn't in the token, you see an "interrupt" (pending MFA) and a failure for ToU in the logs, even if the ToU was accepted in a previous sign-in.
216
+- After completing multifactor authentication, a second log entry appears, validating the ToU. If the user already accepted the ToU, you see success for both MFA and ToU.
212217
- If a valid MFA claim is present in the token, a single log shows success for both MFA and ToU.
213218
214219
If multiple policies are applied to a user requiring MFA, Device State, and ToU, the process is similar. The validation order is MFA, Device State, and then ToU.
215220
216221
### Custom controls (preview)
217222
218
−Custom controls are a preview capability of Microsoft Entra ID. When you use custom controls, your users are redirected to a compatible service to satisfy authentication requirements that are separate from Microsoft Entra ID. For more information, check out the [Custom controls](controls.md) article.
223
+Custom controls are a preview capability of Microsoft Entra ID. Using custom controls redirects your users to a compatible service to satisfy authentication requirements separate from Microsoft Entra ID. For more information, check out the [Custom controls](controls.md) article.
219224
220225
## Next steps
221226
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 18:27 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.