Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 47512ed · +41 −16 lines · also on GitHub
⋯ 9 unchanged lines
1010
---
1111
# Microsoft-managed Conditional Access policies
1212
13
−## Overview
13
+Every day, Microsoft processes more than 100 trillion security signals from endpoints, cloud services, identity systems, and more. We use this data shape how we respond to threats and inform how we innovate to help build a safer digital future. Read about the work we're doing in the [Microsoft Digital Defense Report](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1).
1414
15
−As mentioned in the [Microsoft Digital Defense Report](https://www.microsoft.com/security/security-insider/microsoft-digital-defense-report-2023) from October 2023,
15
+As part of this work, Microsoft-managed policies are available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which continues to reduce the risk of compromise by more than 99%.
1616
17
−> ...threats to digital peace have reduced trust in technology and highlighted the urgent need for improved cyber defenses at all levels...
18
−>
19
−> ...at Microsoft, our more than 10,000 security experts analyze over 65 trillion signals each day... driving some of the most influential insights in
20
−cybersecurity. Together, we can build cyber resilience through innovative action and collective defense.
17
+:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded.png":::
2118
22
−As part of this work, we're making Microsoft-managed policies available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which a [recent study](https://arxiv.org/abs/2305.00945) finds reduces the risk of compromise by more than 99%.
19
+## Prerequisites
2320
24
−:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded-full.png":::
21
+- [Microsoft Entra ID P2](../../fundamentals/licensing.md) or [Microsoft 365 Business Premium licenses](/office365/servicedescriptions/office-365-service-descriptions-technet-library) is required to use Conditional Access features
22
+- The [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role is the least privileged role required to view Conditional Access policies.
23
+- For a full list of roles, see [Least privileged roles by task](../../identity/role-based-access-control/delegate-by-task.md#security---conditional-access-least-privileged-roles).
2524
2625
## How Microsoft-managed policies work
2726
28
−Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access** > **Policies**.
27
+Microsoft-managed policies are preconfigured Conditional Access policies that are created and maintained by Microsoft to help protect you against common identity risks. Microsoft creates and deploys these policies directly to eligible tenants based on licensing and feature eligibility. When a policy is introduced:
2928
30
−You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
29
+- The policy is automatically created in your tenant in a **Report-only** state.
30
+- The policy includes preconfigured conditions and recommended controls, such as requiring multifactor authentication.
31
+- Administrators don't need to manually create these policies. Microsoft manages the policy template, configuration, and updates to ensure it aligns with current security guidance.
3132
3233
Microsoft enables these policies no less than 45 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 28 days before the policies are enabled.
3334
⋯ 3 unchanged lines
3738
> - It's mentioned in emails and Microsoft 365 message center posts you receive about Microsoft-managed policies.
3839
> - It's mentioned in the policy details in the Microsoft Entra admin center.
3940
40
−## Policies
41
−
42
−These Microsoft-managed policies allow administrators to make simple modifications like excluding users or turning them from report-only mode to on or off. Organizations can't rename or delete any Microsoft-managed policies. As administrators get more comfortable with Conditional Access policy, they might choose to duplicate the policy to create custom versions.
43
−
4441
As threats evolve, Microsoft might update these policies to use new features, functionality, or improve their effectiveness. Microsoft‑managed Conditional Access policies automatically adapt to changes within a tenant to maintain consistent security posture without requiring administrator action. As Microsoft identifies new users, groups, or workloads that meet the eligibility criteria for an existing MMP policy, they are automatically included in the policy’s scope. These updates do not modify the policy’s settings, conditions, or grant controls, and any admin‑configured exclusions are always preserved to prevent accidental lockouts. This ensures that coverage stays current as the tenant evolves, while maintaining predictable behavior for administrators. Microsoft communicates these updates through standard notification channels to keep tenants informed.
4542
43
+## Policies
4644
45
+These Microsoft-managed policies allow administrators to make simple modifications like excluding users or turning them from report-only mode to on or off. Organizations can't rename or delete any Microsoft-managed policies.
46
+
4747
- [Block all high risk agents from accessing all resources](#block-all-high-risk-agents-from-accessing-all-resources-preview) (Preview)
48
−- [Block legacy authentication](#block-legacy-authentication)
48
+- [Block legacy authentication](#block-legacy-authentication) (also a Baseline security mode policy)
4949
- [Block device code flow](#block-device-code-flow)
5050
- [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals)
5151
- [Multifactor authentication for all users](#multifactor-authentication-for-all-users)
5252
- [Multifactor authentication for per-user multifactor authentication users](#multifactor-authentication-for-per-user-multifactor-authentication-users)
5353
- [Multifactor authentication and reauthentication for risky sign-ins](#multifactor-authentication-and-reauthentication-for-risky-sign-ins)
5454
- [Block access for high-risk users](#block-access-for-high-risk-users)
55
+- [Require phishing resistant authentication for admins](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) (Baseline security mode policy)
5556
57
+## How to access and manage Microsoft-managed policies
58
+
59
+Microsoft-managed policies appear in the same list as all of your other Conditional Access policies.
60
+
61
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).
62
+1. Browse to **Entra ID** > **Conditional Access** > **Policies**.
63
+1. Select a policy that shows **Microsoft** in the **Created by** column.
64
+
65
+:::image type="content" source="media/managed-policies/microsoft-managed-policy-list.png" alt-text="Screenshot of the Conditional Access policies with Microsoft-managed policies highlighted." lightbox="media/managed-policies/microsoft-managed-policy-list-expanded.png":::
66
+
67
+You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
68
+
69
+### Baseline security mode policies
70
+
71
+[Baseline security mode (BSM)](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) in the Microsoft 365 admin center bundles recommended security settings and policies for Microsoft 365 workloads. Two of these settings show up as Conditional Access policies:
72
+
73
+- Require phishing resistant authentication for admins
74
+- Block legacy authentication
75
+
76
+These policies are based on the Microsoft-managed policy framework, but they show up as **Baseline security mode** in the **Created by** column. BSM policies are managed in the Microsoft 365 admin center. For steps on how to manage these policies, see [Baseline security mode policies](/microsoft-365/baseline-security-mode/baseline-security-mode-settings#how-to-access-baseline-security-mode-settings).
77
+
78
+:::image type="content" source="media/managed-policies/baseline-security-mode-policies-list.png" alt-text="Screenshot of the Security Baseline Mode policies in the Conditional Access policies list." lightbox="media/managed-policies/baseline-security-mode-policies-list.png":::
79
+
80
+One important difference between BSM policies and Microsoft-managed policies is that the BSM policies are created by the administrator, not Microsoft.
81
+
5682
### Block all high risk agents from accessing all resources (Preview)
5783
5884
This policy blocks agent identities that are determined as 'high risk' from accessing resources in your tenant. The agent risk level is based on detections from [Microsoft Entra ID Protection](/entra/id-protection/concept-risky-agents).
⋯ 52 unchanged lines
111137
- This setup ensures that the policy doesn't block legitimate users and that you’re getting maximum value on your P2 licenses.
112138
113139
To prevent attackers from taking over accounts, Microsoft blocks risky users from registering for multifactor authentication.
114
−
115140
116141
### Block access for high-risk users
117142
⋯ 116 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.