Microsoft-managed Conditional Access policies

This page's changes and edits · All guidance changes

Microsoft's edit · 28 May 20:14 UTC

Link MMP Block device code flow section to Teams devices guidance (AB#581861)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3fce2e2 · +43 ~~−28~~ lines · also on GitHub

⋯ 3 unchanged lines

44 ms.service: entra-id

55 ms.subservice: conditional-access

66 ms.topic: concept-article

7 −ms.date: 05/20/2026

7 +ms.date: 05/28/2026

88 ms.reviewer: swethar

99 ms.custom: sfi-image-nochange

10 −ai-usage: ai-assisted

1110 ---

1211 # Microsoft-managed Conditional Access policies

1312

⋯ 84 unchanged lines

9897

9998 Device code flow is rarely used by customers, but is frequently used by attackers. Enabling this Microsoft-managed policy for your organization helps remove this attack vector.

10099

100 +If your organization uses Microsoft Teams devices that require device code flow, follow the guidance in [Restrict device code flow for Microsoft Teams devices with Conditional Access](policy-teams-devices-device-code-flow.md) to scope exceptions correctly while continuing to block device code flow for other accounts.

101 +

101102 ### Multifactor authentication for admins accessing Microsoft Admin portals

102103

103104 This policy covers [14 admin roles](#what-administrator-roles-are-covered-by-these-policies) that are highly privileged, who access the [Microsoft Admin Portals](policy-old-require-mfa-admin-portals.md), and requires them to perform multifactor authentication.

⋯ 48 unchanged lines

152153

153154 Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.

154155

155 −## Upgrade from security defaults

156 +## Security defaults policies

156157

157 −When organizations [disable security defaults](../../fundamentals/security-defaults.md#disabling-security-defaults) to adopt Conditional Access, Microsoft automatically creates managed policies in the tenant to maintain the same protections. These policies ensure there's no gap in security coverage during the transition.

158 +The following policies are available for when you upgrade from using security defaults.

158159

159 −The following managed policies are created as part of the upgrade:

160 +- [Block legacy authentication](#block-legacy-authentication)

161 +- [Require multifactor authentication for Azure management](#require-multifactor-authentication-for-azure-management)

162 +- [Require multifactor authentication for admins](#require-multifactor-authentication-for-admins)

163 +- [Require multifactor authentication for all users](#require-multifactor-authentication-for-all-users)

160164

161 −| Upgrade policy | Similar Microsoft-managed policy | Notes |

162 −| --- | --- | --- |

163 −| Block legacy authentication | [Block legacy authentication](#block-legacy-authentication) | Same scope. Blocks sign-in attempts from clients using legacy authentication protocols. |

164 −| Require multifactor authentication for Azure management | *No equivalent* | Unique to the security defaults upgrade. Requires MFA for all users accessing Azure Resource Manager services, including the Azure portal, Microsoft Entra admin center, Azure PowerShell, and Azure CLI. |

165 −| Require multifactor authentication for admins | [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals) | Broader scope. Requires MFA for privileged admin roles signing in to *all applications*, not just admin portals. Also includes Authentication Policy Administrator and Identity Governance Administrator roles. |

166 −| Require multifactor authentication for all users | [Multifactor authentication for all users](#multifactor-authentication-for-all-users) | Same scope. Requires MFA for all users in the organization. |

165 +### Block legacy authentication

167166

168 −## Monitor and review

167 +This policy blocks legacy authentication protocols from accessing applications. Legacy authentication refers to an authentication request made by:

169168

170 −To see the effect of these policies on your organization and investigate changes to the policies, you have a few options.

169 +- Clients that don't use modern authentication (for example, an Office 2010 client)

170 +- Any client that uses older mail protocols such as IMAP, SMTP, or POP3

171 +- Any sign-in attempts to use legacy authentication.

172 +

173 +Most observed compromising sign-in attempts come from legacy authentication. Because legacy authentication doesn't support multifactor authentication, attackers can bypass multifactor authentication requirements by using older protocols.

171174

172 −### Policy impact

175 +### Require multifactor authentication for Azure management

173176

174 −Select the **Policy impact** tab of the managed policy from within Conditional Access to see a summary of how the policy affects your environment. Adjust the filter, data format, and more to explore the policy's effect, even on report-only policies.

177 +This policy covers all users when they're trying to access various Azure services managed through the Windows Azure Service Management API including:

175178

176 −:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact-on-sign-in.png" alt-text="Screenshot showing the effect of a policy on the organization.":::

179 +- Azure portal

180 +- Microsoft Entra admin center

181 +- Azure PowerShell

182 +- Azure CLI

177183

178 −### Sign-in logs

184 +Users must complete multifactor authentication to access these resources.

179185

186 +### Require multifactor authentication for admins

187 +

188 +This policy applies to users with highly privileged admin roles:

189 +

190 +[!INCLUDE [conditional-access-admin-roles](../../includes/conditional-access-admin-roles.md)]

191 +

192 +These accounts must use multifactor authentication to sign in to any application.

193 +

194 +### Require multifactor authentication for all users

195 +

196 +This policy applies to all users in your organization and requires multifactor authentication for every sign-in. In most cases, sessions persist on devices, so users don't need to complete multifactor authentication when interacting with other applications.

197 +

198 +## Monitor and review

199 +

200 +The managed policy and the sign-in logs are the two places where you can see the effect of these policies on your organization.

201 +

202 +Review the **Policy impact** tab of the managed policy to see a summary of how the policy affects your environment.

203 +

204 +:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact-on-sign-in.png" alt-text="Screenshot showing the effect of a policy on the organization.":::

205 +

180206 Analyze the **Microsoft Entra sign-in logs** to see details about how the policies affect sign-in activity.

181207

182208 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).

⋯ 6 unchanged lines

189215 1. Select a specific sign-in event, then select **Conditional Access**.

190216 - To investigate further, select the **Policy Name** to drill down into the configuration of the policies.

191217 1. Explore the other tabs to see the **client user** and **device details** that were used for the Conditional Access policy assessment.

192 −

193 −### Audit logs

194 −

195 −The **Microsoft Entra audit logs** are helpful when investigating changes made to a policy.

196 −

197 −1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).

198 −1. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**.

199 −1. Set the **Service** filter to **Conditional Access**.

200 −1. If needed, select a specific **Activity** filter.

201 −

202 −The **Target(s)** column displays the name of the policy that was updated. Microsoft-managed policy names start with **Microsoft-managed:** so you can easily filter for them.

203218

204219 ## Common questions

205220

⋯ 42 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.