Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8c922f8 · +21 −7 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: conditional-access
66
ms.topic: concept-article
7
−ms.date: 05/28/2026
7
+ms.date: 05/20/2026
88
ms.reviewer: swethar
99
ms.custom: sfi-image-nochange
10
+ai-usage: ai-assisted
1011
---
1112
# Microsoft-managed Conditional Access policies
1213
⋯ 84 unchanged lines
9798
9899
Device code flow is rarely used by customers, but is frequently used by attackers. Enabling this Microsoft-managed policy for your organization helps remove this attack vector.
99100
100
−If your organization uses Microsoft Teams devices that require device code flow, follow the guidance in [Restrict device code flow for Microsoft Teams devices with Conditional Access](policy-teams-devices-device-code-flow.md) to scope exceptions correctly while continuing to block device code flow for other accounts.
101
−
102101
### Multifactor authentication for admins accessing Microsoft Admin portals
103102
104103
This policy covers [14 admin roles](#what-administrator-roles-are-covered-by-these-policies) that are highly privileged, who access the [Microsoft Admin Portals](policy-old-require-mfa-admin-portals.md), and requires them to perform multifactor authentication.
⋯ 48 unchanged lines
153152
154153
Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.
155154
156
−## Security defaults policies
155
+## Upgrade from security defaults
157156
158157
The following policies are available for when you upgrade from using security defaults.
159158
⋯ 33 unchanged lines
193192
194193
### Require multifactor authentication for all users
195194
196
−This policy applies to all users in your organization and requires multifactor authentication for every sign-in. In most cases, sessions persist on devices, so users don't need to complete multifactor authentication when interacting with other applications.
195
+This policy applies to all users in your organization and requires multifactor authentication for every sign-in. In most cases, sessions persist on devices, so users don't need to complete multifactor authentication when interacting with other applications.
197196
198197
## Monitor and review
199198
200
−The managed policy and the sign-in logs are the two places where you can see the effect of these policies on your organization.
199
+To see the effect of these policies on your organization and investigate changes to the policies, you have a few options.
201200
202
−Review the **Policy impact** tab of the managed policy to see a summary of how the policy affects your environment.
201
+### Policy impact
203202
203
+Select the **Policy impact** tab of the managed policy from within Conditional Access to see a summary of how the policy affects your environment. Adjust the filter, data format, and more to explore the policy's effect, even on report-only policies.
204
+
204205
:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact-on-sign-in.png" alt-text="Screenshot showing the effect of a policy on the organization.":::
205206
207
+### Sign-in logs
208
+
206209
Analyze the **Microsoft Entra sign-in logs** to see details about how the policies affect sign-in activity.
207210
208211
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).
⋯ 6 unchanged lines
215218
1. Select a specific sign-in event, then select **Conditional Access**.
216219
- To investigate further, select the **Policy Name** to drill down into the configuration of the policies.
217220
1. Explore the other tabs to see the **client user** and **device details** that were used for the Conditional Access policy assessment.
221
+
222
+### Audit logs
223
+
224
+The **Microsoft Entra audit logs** are helpful when investigating changes made to a policy.
225
+
226
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).
227
+1. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**.
228
+1. Set the **Service** filter to **Conditional Access**.
229
+1. If needed, select a specific **Activity** filter.
230
+
231
+The **Target(s)** column displays the name of the policy that was updated. Microsoft-managed policy names start with **Microsoft-managed:** so you can easily filter for them.
218232
219233
## Common questions
220234
⋯ 42 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.