Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 0a6f7ed · +85 −71 lines · also on GitHub
11
---
22
title: Microsoft-Managed Conditional Access Policies for Enhanced Security
33
description: Secure your resources with Microsoft-managed Conditional Access policies. Require multifactor authentication to reduce compromise risks.
4
−ms.service: entra-id
5
−ms.subservice: conditional-access
6
−ms.topic: concept-article
7
−ms.date: 11/06/2025
4
+ms.topic: article
5
+ms.date: 03/18/2026
6
+ms.author: sarahlipsey
7
+author: shlipsey3
8
+manager: pmwongera
89
ms.reviewer: swethar
910
ms.custom: sfi-image-nochange
1011
---
1112
# Microsoft-managed Conditional Access policies
1213
13
−As mentioned in the [Microsoft Digital Defense Report](https://www.microsoft.com/security/security-insider/microsoft-digital-defense-report-2023) from October 2023,
14
+Every day, Microsoft processes more than 100 trillion security signals from endpoints, cloud services, identity systems, and more. We use this data shape how we respond to threats and inform how we innovate to help build a safer digital future. Read about the work we're doing in the [Microsoft Digital Defense Report](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1).
1415
15
−> ...threats to digital peace have reduced trust in technology and highlighted the urgent need for improved cyber defenses at all levels...
16
−>
17
−> ...at Microsoft, our more than 10,000 security experts analyze over 65 trillion signals each day... driving some of the most influential insights in
18
−cybersecurity. Together, we can build cyber resilience through innovative action and collective defense.
16
+As part of this work, Microsoft-managed policies are available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which continues to reduce the risk of compromise by more than 99%.
1917
20
−As part of this work, we're making Microsoft-managed policies available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which a [recent study](https://arxiv.org/abs/2305.00945) finds reduces the risk of compromise by more than 99%.
18
+:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded.png":::
2119
22
−:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded-full.png":::
20
+## Prerequisites
2321
22
+- [Microsoft Entra ID P2](../../fundamentals/licensing.md) or [Microsoft 365 Business Premium licenses](/office365/servicedescriptions/office-365-service-descriptions-technet-library) is required to use Conditional Access features
23
+- The [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role is the least privileged role required to view Conditional Access policies.
24
+- For a full list of roles, see [Lease privileged roles by task](../../identity/role-based-access-control/delegate-by-task.md#security---conditional-access-least-privileged-roles).
25
+
2426
## How Microsoft-managed policies work
2527
26
−Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access** > **Policies**.
28
+Microsoft-managed policies are preconfigured Conditional Access policies that are created and maintained by Microsoft to help protect you against common identity risks. Microsoft creates and deploys these policies directly to eligible tenants based on licensing and feature eligibility. When a policy is introduced:
2729
28
−You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
30
+- The policy is automatically created in your tenant in a **Report-only** state.
31
+- The policy includes preconfigured conditions and recommended controls, such as requiring multifactor authentication.
32
+- Administrators don't need to manually create these policies. Microsoft manages the policy template, configuration, and updates to ensure it aligns with current security guidance.
2933
3034
Microsoft enables these policies no less than 45 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 28 days before the policies are enabled.
3135
⋯ 3 unchanged lines
3539
> - It's mentioned in emails and Microsoft 365 message center posts you receive about Microsoft-managed policies.
3640
> - It's mentioned in the policy details in the Microsoft Entra admin center.
3741
38
−## Policies
42
+As threats evolve, Microsoft might update these policies to use new features, functionality, or improve their effectiveness. Microsoft‑managed Conditional Access policies automatically adapt to changes within a tenant to maintain consistent security posture without requiring administrator action. As Microsoft identifies new users, groups, or workloads that meet the eligibility criteria for an existing MMP policy, they are automatically included in the policy’s scope. These updates do not modify the policy’s settings, conditions, or grant controls, and any admin‑configured exclusions are always preserved to prevent accidental lockouts. This ensures that coverage stays current as the tenant evolves, while maintaining predictable behavior for administrators. Microsoft communicates these updates through standard notification channels to keep tenants informed.
3943
4044
These Microsoft-managed policies allow administrators to make simple modifications like excluding users or turning them from report-only mode to on or off. Organizations can't rename or delete any Microsoft-managed policies. As administrators get more comfortable with Conditional Access policy, they might choose to duplicate the policy to create custom versions.
4145
42
−As threats evolve, Microsoft might update these policies to use new features, functionality, or improve their effectiveness. Microsoft‑managed Conditional Access policies automatically adapt to changes within a tenant to maintain consistent security posture without requiring administrator action. As Microsoft identifies new users, groups, or workloads that meet the eligibility criteria for an existing MMP policy, they are automatically included in the policy’s scope. These updates do not modify the policy’s settings, conditions, or grant controls, and any admin‑configured exclusions are always preserved to prevent accidental lockouts. This ensures that coverage stays current as the tenant evolves, while maintaining predictable behavior for administrators. Microsoft communicates these updates through standard notification channels to keep tenants informed.
46
+## How to access and manage Microsoft-managed policies
4347
48
+Microsoft-managed policies appear in the same list as all of your other Conditional Access policies.
4449
50
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).
51
+1. Browse to **Entra ID** > **Conditional Access** > **Policies**.
52
+1. Select a policy that shows **Microsoft** in the **Created by** column.
53
+
54
+:::image type="content" source="media/managed-policies/microsoft-managed-policy-list.png" alt-text="Screenshot of the Conditional Access policies with Microsoft-managed policies highlighted." lightbox="media/managed-policies/microsoft-managed-policy-list-expanded.png":::
55
+
56
+You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
57
+
58
+### Baseline Security Mode policies
59
+
60
+[Baseline Security Mode (BSM)](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) in the Microsoft 365 admin center bundles recommended security settings and policies for Microsoft 365 workloads. Two of these settings show up as Conditional Access policies:
61
+
62
+- Require phishing resistant authentication for admins
63
+- Block legacy authentication
64
+
65
+These policies are deployed in Microsoft Entra as Microsoft-managed policies, but they show up as **Baseline Security Mode** in the **Created by** column.
66
+
67
+:::image type="content" source="media/managed-policies/baseline-security-mode-policies-list.png" alt-text="Screenshot of the Security Baseline Mode policies in the Conditional Access policies list." lightbox="media/managed-policies/baseline-security-mode-policies-list-expanded.png":::
68
+
69
+One important difference between BSM policies and Microsoft-managed policies is that the BSM policies are created by the administrator, not Microsoft.
70
+
71
+## Policies
72
+
73
+The following Microsoft-managed policies are currently available:
74
+
4575
- [Block all high risk agents from accessing all resources](#block-all-high-risk-agents-from-accessing-all-resources-preview) (Preview)
46
−- [Block legacy authentication](#block-legacy-authentication)
76
+- [Block legacy authentication](#block-legacy-authentication) (also a Baseline Security Mode policy)
4777
- [Block device code flow](#block-device-code-flow)
4878
- [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals)
4979
- [Multifactor authentication for all users](#multifactor-authentication-for-all-users)
5080
- [Multifactor authentication for per-user multifactor authentication users](#multifactor-authentication-for-per-user-multifactor-authentication-users)
5181
- [Multifactor authentication and reauthentication for risky sign-ins](#multifactor-authentication-and-reauthentication-for-risky-sign-ins)
52
−- [Block access for high-risk users](#block-access-for-high-risk-users)
82
+- [Require phishing resistant authentication for admins](#require-phishing-resistant-authentication-for-admins) (Baseline Security Mode policy)
5383
5484
### Block all high risk agents from accessing all resources (Preview)
5585
56
−This policy blocks agent identities that are determined as 'high risk' from accessing resources in your tenant. The agent risk level is based on detections from [Microsoft Entra ID Protection](/entra/id-protection/concept-risky-agents).
86
+This policy blocks agent identities that are determined as 'high risk' from accessing resources in your tenant. The agent risk level is based on detections from [Microsoft Entra ID Protection for agents](/entra/id-protection/concept-risky-agents).
5787
5888
### Block legacy authentication
5989
⋯ 33 unchanged lines
93123
To apply this policy to more users, duplicate it and change the assignments.
94124
95125
> [!TIP]
96
−> Using the **Edit** pencil at the top to modify the Microsoft-managed per-user multifactor authentication policy might result in a **failed to update** error. To work around this issue, select **Edit** under the **Excluded identities** section of the policy.
126
+> Using the **Edit** pencil at the top to modify the Microsoft-managed per-user multifactor authentication policy might result in a **failed to update** error. To avoid this issue, select **Edit** under the **Excluded identities** section of the policy instead.
97127
98128
### Multifactor authentication and reauthentication for risky sign-ins
99129
⋯ 10 unchanged lines
110140
111141
To prevent attackers from taking over accounts, Microsoft blocks risky users from registering for multifactor authentication.
112142
113
−
114
−### Block access for high-risk users
115
−
116
−This policy helps protect your organization by restricting access for users identified as high risk by Microsoft Entra ID Protection. User risk represents the likelihood that a user account has been compromised, based on signals such as leaked credentials or other risk detections. When enabled, this policy blocks access for users who meet the configured high user risk level until the risk is remediated. Remediation follows existing Microsoft Entra ID Protection processes and guidance.
117
−
118
−This policy targets:
119
−
120
−- Organizations with Microsoft Entra ID P2 licenses
121
−- Organizations where security defaults aren't enabled
122
−
123
−Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.
124
−
125
−## Security defaults policies
126
−
127
−The following policies are available for when you upgrade from using security defaults.
128
−
129
−- [Block legacy authentication](#block-legacy-authentication)
130
−- [Require multifactor authentication for Azure management](#require-multifactor-authentication-for-azure-management)
131
−- [Require multifactor authentication for admins](#require-multifactor-authentication-for-admins)
132
−- [Require multifactor authentication for all users](#require-multifactor-authentication-for-all-users)
133
−
134
−### Block legacy authentication
135
−
136
−This policy blocks legacy authentication protocols from accessing applications. Legacy authentication refers to an authentication request made by:
137
−
138
−- Clients that don't use modern authentication (for example, an Office 2010 client)
139
−- Any client that uses older mail protocols such as IMAP, SMTP, or POP3
140
−- Any sign-in attempts to use legacy authentication.
141
−
142
−Most observed compromising sign-in attempts come from legacy authentication. Because legacy authentication doesn't support multifactor authentication, attackers can bypass multifactor authentication requirements by using older protocols.
143
−
144
−### Require multifactor authentication for Azure management
145
−
146
−This policy covers all users when they're trying to access various Azure services managed through the Windows Azure Service Management API including:
147
−
148
−- Azure portal
149
−- Microsoft Entra admin center
150
−- Azure PowerShell
151
−- Azure CLI
152
−
153
−Users must complete multifactor authentication to access these resources.
154
−
155
−### Require multifactor authentication for admins
143
+## Upgrade from security defaults
156144
157
−This policy applies to users with highly privileged admin roles:
145
+When organizations [disable security defaults](../../fundamentals/security-defaults.md#disabling-security-defaults) to adopt Conditional Access, Microsoft automatically creates managed policies in the tenant to maintain the same protections. These policies ensure there's no gap in security coverage during the transition.
158146
159
−[!INCLUDE [conditional-access-admin-roles](../../includes/conditional-access-admin-roles.md)]
147
+The following managed policies are created as part of the upgrade:
160148
161
−These accounts must use multifactor authentication to sign in to any application.
149
+| Upgrade policy | Similar Microsoft-managed policy | Notes |
150
+| --- | --- | --- |
151
+| Block legacy authentication | [Block legacy authentication](#block-legacy-authentication) | Same scope. Blocks sign-in attempts from clients using legacy authentication protocols. |
152
+| Require multifactor authentication for Azure management | *No equivalent* | Unique to the security defaults upgrade. Requires MFA for all users accessing Azure Resource Manager services, including the Azure portal, Microsoft Entra admin center, Azure PowerShell, and Azure CLI. |
153
+| Require multifactor authentication for admins | [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals) | Broader scope. Requires MFA for privileged admin roles signing in to *all applications*, not just admin portals. Also includes Authentication Policy Administrator and Identity Governance Administrator roles. |
154
+| Require multifactor authentication for all users | [Multifactor authentication for all users](#multifactor-authentication-for-all-users) | Same scope. Requires MFA for all users in the organization. |
162155
163
−### Require multifactor authentication for all users
156
+## Monitor and review
164157
165
−This policy applies to all users in your organization and requires multifactor authentication for every sign-in. In most cases, sessions persist on devices, so users don't need to complete multifactor authentication when interacting with other applications.
158
+To see the effect of these policies on your organization and investigate changes to the policies, you have a few options.
166159
167
−## Monitor and review
160
+### Policy impact
168161
169
−The managed policy and the sign-in logs are the two places where you can see the effect of these policies on your organization.
162
+Select the **Policy impact** tab of the managed policy from within Conditional access to see a summary of how the policy affects your environment. Adjust the filter, data format, and more to explore the policy's effect, even on report-only policies.
170163
171
−Review the **Policy impact** tab of the managed policy to see a summary of how the policy affects your environment.
164
+:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact.png" alt-text="Screenshot showing the effect of a policy on the organization.":::
172165
173
−:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact-on-sign-in.png" alt-text="Screenshot showing the effect of a policy on the organization.":::
166
+### Sign-in logs
174167
175168
Analyze the **Microsoft Entra sign-in logs** to see details about how the policies affect sign-in activity.
176169
⋯ 8 unchanged lines
185178
- To investigate further, select the **Policy Name** to drill down into the configuration of the policies.
186179
1. Explore the other tabs to see the **client user** and **device details** that were used for the Conditional Access policy assessment.
187180
181
+### Audit logs
182
+
183
+The **Microsoft Entra audit logs** are helpful when investigating changes made to a policy.
184
+
185
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).
186
+1. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**.
187
+1. Set the **Service** filter to **Conditional Access**.
188
+1. If needed, select a specific **Activity** filter.
189
+
190
+The **Target(s)** column displays the name of the policy that was updated. Microsoft-managed policy names start with **Microsoft-managed**.
191
+
192
+The **Initiated by (actor)** column indicates who made the change. For Microsoft-managed policies, the value can be either **Microsoft Managed Policy Manager** or a user from your organization. Some changes to Microsoft-managed policies must be initiated or enabled by an administrator.
193
+
188194
## Common questions
189195
190196
### What is Conditional Access?
⋯ 33 unchanged lines
224230
### How do I monitor when Microsoft makes a change to these policies or adds a new one?
225231
226232
Administrators with **AuditLog.Read.All** and **Directory.Read** permissions can query the audit log for entries initiated by **Microsoft Managed Policy Manager** in the **Policy** category. For example, use [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to find entries with this query string: `https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=initiatedBy/app/displayName eq 'Microsoft Managed Policy Manager' and category eq 'Policy'`.
233
+
234
+In the Microsoft Entra admin center, use the following filter to narrow the audit log results.
235
+
236
+- Category: Conditional Access
237
+- Filter: Target(s) = "Microsoft-managed"
238
+- Filter: Initiated by (actor) = "Microsoft Managed Policy Manager"
239
+
240
+Keep in mind that some activities on a Microsoft-managed policy might be initiated by a user, not the Microsoft Managed Policy Manager.
227241
228242
## Related content
229243
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 18:27 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.