Microsoft-managed Conditional Access policies

This page's changes and edits · All guidance changes

Microsoft's edit · 20 May 18:19 UTC

managed-policies-052026

Microsoft's commit message in MicrosoftDocs/entra-docs · commit a454cd9 · +28 ~~−41~~ lines · also on GitHub

⋯ 3 unchanged lines

44 ms.service: entra-id

55 ms.subservice: conditional-access

66 ms.topic: concept-article

7 −ms.date: 03/24/2026

7 +ms.date: 05/20/2026

88 ms.reviewer: swethar

99 ms.custom: sfi-image-nochange

10 +ai-usage: ai-assisted

1011 ---

1112 # Microsoft-managed Conditional Access policies

1213

⋯ 138 unchanged lines

151152

152153 Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.

153154

154 −## Security defaults policies

155 −

156 −The following policies are available for when you upgrade from using security defaults.

157 −

158 −- [Block legacy authentication](#block-legacy-authentication)

159 −- [Require multifactor authentication for Azure management](#require-multifactor-authentication-for-azure-management)

160 −- [Require multifactor authentication for admins](#require-multifactor-authentication-for-admins)

161 −- [Require multifactor authentication for all users](#require-multifactor-authentication-for-all-users)

162 −

163 −### Block legacy authentication

164 −

165 −This policy blocks legacy authentication protocols from accessing applications. Legacy authentication refers to an authentication request made by:

166 −

167 −- Clients that don't use modern authentication (for example, an Office 2010 client)

168 −- Any client that uses older mail protocols such as IMAP, SMTP, or POP3

169 −- Any sign-in attempts to use legacy authentication.

170 −

171 −Most observed compromising sign-in attempts come from legacy authentication. Because legacy authentication doesn't support multifactor authentication, attackers can bypass multifactor authentication requirements by using older protocols.

172 −

173 −### Require multifactor authentication for Azure management

174 −

175 −This policy covers all users when they're trying to access various Azure services managed through the Windows Azure Service Management API including:

176 −

177 −- Azure portal

178 −- Microsoft Entra admin center

179 −- Azure PowerShell

180 −- Azure CLI

181 −

182 −Users must complete multifactor authentication to access these resources.

183 −

184 −### Require multifactor authentication for admins

185 −

186 −This policy applies to users with highly privileged admin roles:

187 −

188 −[!INCLUDE [conditional-access-admin-roles](../../includes/conditional-access-admin-roles.md)]

155 +## Upgrade from security defaults

189156

190 −These accounts must use multifactor authentication to sign in to any application.

157 +When organizations [disable security defaults](../../fundamentals/security-defaults.md#disabling-security-defaults) to adopt Conditional Access, Microsoft automatically creates managed policies in the tenant to maintain the same protections. These policies ensure there's no gap in security coverage during the transition.

191158

192 −### Require multifactor authentication for all users

159 +The following managed policies are created as part of the upgrade:

193160

194 −This policy applies to all users in your organization and requires multifactor authentication for every sign-in. In most cases, sessions persist on devices, so users don't need to complete multifactor authentication when interacting with other applications.

161 +| Upgrade policy | Similar Microsoft-managed policy | Notes |

162 +| --- | --- | --- |

163 +| Block legacy authentication | [Block legacy authentication](#block-legacy-authentication) | Same scope. Blocks sign-in attempts from clients using legacy authentication protocols. |

164 +| Require multifactor authentication for Azure management | *No equivalent* | Unique to the security defaults upgrade. Requires MFA for all users accessing Azure Resource Manager services, including the Azure portal, Microsoft Entra admin center, Azure PowerShell, and Azure CLI. |

165 +| Require multifactor authentication for admins | [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals) | Broader scope. Requires MFA for privileged admin roles signing in to *all applications*, not just admin portals. Also includes Authentication Policy Administrator and Identity Governance Administrator roles. |

166 +| Require multifactor authentication for all users | [Multifactor authentication for all users](#multifactor-authentication-for-all-users) | Same scope. Requires MFA for all users in the organization. |

195167

196168 ## Monitor and review

197169

198 −The managed policy and the sign-in logs are the two places where you can see the effect of these policies on your organization.

170 +To see the effect of these policies on your organization and investigate changes to the policies, you have a few options.

199171

200 −Review the **Policy impact** tab of the managed policy to see a summary of how the policy affects your environment.

172 +### Policy impact

201173

174 +Select the **Policy impact** tab of the managed policy from within Conditional Access to see a summary of how the policy affects your environment. Adjust the filter, data format, and more to explore the policy's effect, even on report-only policies.

175 +

202176 :::image type="content" source="media/managed-policies/microsoft-managed-policy-impact-on-sign-in.png" alt-text="Screenshot showing the effect of a policy on the organization.":::

203177

178 +### Sign-in logs

179 +

204180 Analyze the **Microsoft Entra sign-in logs** to see details about how the policies affect sign-in activity.

205181

206182 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).

⋯ 6 unchanged lines

213189 1. Select a specific sign-in event, then select **Conditional Access**.

214190 - To investigate further, select the **Policy Name** to drill down into the configuration of the policies.

215191 1. Explore the other tabs to see the **client user** and **device details** that were used for the Conditional Access policy assessment.

192 +

193 +### Audit logs

194 +

195 +The **Microsoft Entra audit logs** are helpful when investigating changes made to a policy.

196 +

197 +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).

198 +1. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**.

199 +1. Set the **Service** filter to **Conditional Access**.

200 +1. If needed, select a specific **Activity** filter.

201 +

202 +The **Target(s)** column displays the name of the policy that was updated. Microsoft-managed policy names start with **Microsoft-managed:** so you can easily filter for them.

216203

217204 ## Common questions

218205

⋯ 42 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.