Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b29c07b · +68 −88 lines · also on GitHub
11
---
22
title: Microsoft-Managed Conditional Access Policies for Enhanced Security
33
description: Secure your resources with Microsoft-managed Conditional Access policies. Require multifactor authentication to reduce compromise risks.
4
−ms.topic: article
5
−ms.date: 03/18/2026
6
−ms.author: sarahlipsey
7
−author: shlipsey3
8
−manager: pmwongera
4
+ms.service: entra-id
5
+ms.subservice: conditional-access
6
+ms.topic: concept-article
7
+ms.date: 11/06/2025
98
ms.reviewer: swethar
109
ms.custom: sfi-image-nochange
1110
---
1211
# Microsoft-managed Conditional Access policies
1312
14
−Every day, Microsoft processes more than 100 trillion security signals from endpoints, cloud services, identity systems, and more. We use this data shape how we respond to threats and inform how we innovate to help build a safer digital future. Read about the work we're doing in the [Microsoft Digital Defense Report](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1).
15
−
16
−As part of this work, Microsoft-managed policies are available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which continues to reduce the risk of compromise by more than 99%.
13
+As mentioned in the [Microsoft Digital Defense Report](https://www.microsoft.com/security/security-insider/microsoft-digital-defense-report-2023) from October 2023,
1714
18
−:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded.png":::
15
+> ...threats to digital peace have reduced trust in technology and highlighted the urgent need for improved cyber defenses at all levels...
16
+>
17
+> ...at Microsoft, our more than 10,000 security experts analyze over 65 trillion signals each day... driving some of the most influential insights in
18
+cybersecurity. Together, we can build cyber resilience through innovative action and collective defense.
1919
20
−## Prerequisites
20
+As part of this work, we're making Microsoft-managed policies available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which a [recent study](https://arxiv.org/abs/2305.00945) finds reduces the risk of compromise by more than 99%.
2121
22
−- [Microsoft Entra ID P2](../../fundamentals/licensing.md) or [Microsoft 365 Business Premium licenses](/office365/servicedescriptions/office-365-service-descriptions-technet-library) is required to use Conditional Access features
23
−- The [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role is the least privileged role required to view Conditional Access policies.
24
−- For a full list of roles, see [Lease privileged roles by task](../../identity/role-based-access-control/delegate-by-task.md#security---conditional-access-least-privileged-roles).
22
+:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded-full.png":::
2523
2624
## How Microsoft-managed policies work
2725
28
−Microsoft-managed policies are preconfigured Conditional Access policies that are created and maintained by Microsoft to help protect you against common identity risks. Microsoft creates and deploys these policies directly to eligible tenants based on licensing and feature eligibility. When a policy is introduced:
26
+Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access** > **Policies**.
2927
30
−- The policy is automatically created in your tenant in a **Report-only** state.
31
−- The policy includes preconfigured conditions and recommended controls, such as requiring multifactor authentication.
32
−- Administrators don't need to manually create these policies. Microsoft manages the policy template, configuration, and updates to ensure it aligns with current security guidance.
28
+You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
3329
3430
Microsoft enables these policies no less than 45 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 28 days before the policies are enabled.
3531
⋯ 3 unchanged lines
3935
> - It's mentioned in emails and Microsoft 365 message center posts you receive about Microsoft-managed policies.
4036
> - It's mentioned in the policy details in the Microsoft Entra admin center.
4137
42
−As threats evolve, Microsoft might update these policies to use new features, functionality, or improve their effectiveness. Microsoft‑managed Conditional Access policies automatically adapt to changes within a tenant to maintain consistent security posture without requiring administrator action. As Microsoft identifies new users, groups, or workloads that meet the eligibility criteria for an existing MMP policy, they are automatically included in the policy’s scope. These updates do not modify the policy’s settings, conditions, or grant controls, and any admin‑configured exclusions are always preserved to prevent accidental lockouts. This ensures that coverage stays current as the tenant evolves, while maintaining predictable behavior for administrators. Microsoft communicates these updates through standard notification channels to keep tenants informed.
38
+## Policies
4339
4440
These Microsoft-managed policies allow administrators to make simple modifications like excluding users or turning them from report-only mode to on or off. Organizations can't rename or delete any Microsoft-managed policies. As administrators get more comfortable with Conditional Access policy, they might choose to duplicate the policy to create custom versions.
4541
46
−## How to access and manage Microsoft-managed policies
47
−
48
−Microsoft-managed policies appear in the same list as all of your other Conditional Access policies.
49
−
50
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).
51
−1. Browse to **Entra ID** > **Conditional Access** > **Policies**.
52
−1. Select a policy that shows **Microsoft** in the **Created by** column.
53
−
54
−:::image type="content" source="media/managed-policies/microsoft-managed-policy-list.png" alt-text="Screenshot of the Conditional Access policies with Microsoft-managed policies highlighted." lightbox="media/managed-policies/microsoft-managed-policy-list-expanded.png":::
55
−
56
−You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.
57
−
58
−### Baseline security mode policies
59
−
60
−[Baseline security mode (BSM)](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) in the Microsoft 365 admin center bundles recommended security settings and policies for Microsoft 365 workloads. Two of these settings show up as Conditional Access policies:
61
−
62
−- Require phishing resistant authentication for admins
63
−- Block legacy authentication
64
−
65
−These policies are based on the Microsoft-managed policy framework, but they show up as **Baseline security mode** in the **Created by** column. BSM policies are managed in the Microsoft 365 admin center. For steps on how to manage these policies, see [Baseline security mode policies](/microsoft-365/baseline-security-mode/baseline-security-mode-settings#how-to-access-baseline-security-mode-settings).
66
−
67
−:::image type="content" source="media/managed-policies/baseline-security-mode-policies-list.png" alt-text="Screenshot of the Security Baseline Mode policies in the Conditional Access policies list." lightbox="media/managed-policies/baseline-security-mode-policies-list.png":::
68
−
69
−One important difference between BSM policies and Microsoft-managed policies is that the BSM policies are created by the administrator, not Microsoft.
70
−
71
−## Policies
42
+As threats evolve, Microsoft might update these policies to use new features, functionality, or improve their effectiveness. Microsoft‑managed Conditional Access policies automatically adapt to changes within a tenant to maintain consistent security posture without requiring administrator action. As Microsoft identifies new users, groups, or workloads that meet the eligibility criteria for an existing MMP policy, they are automatically included in the policy’s scope. These updates do not modify the policy’s settings, conditions, or grant controls, and any admin‑configured exclusions are always preserved to prevent accidental lockouts. This ensures that coverage stays current as the tenant evolves, while maintaining predictable behavior for administrators. Microsoft communicates these updates through standard notification channels to keep tenants informed.
7243
73
−The following Microsoft-managed policies are currently available:
7444
7545
- [Block all high risk agents from accessing all resources](#block-all-high-risk-agents-from-accessing-all-resources-preview) (Preview)
76
−- [Block legacy authentication](#block-legacy-authentication) (also a Baseline security mode policy)
46
+- [Block legacy authentication](#block-legacy-authentication)
7747
- [Block device code flow](#block-device-code-flow)
7848
- [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals)
7949
- [Multifactor authentication for all users](#multifactor-authentication-for-all-users)
8050
- [Multifactor authentication for per-user multifactor authentication users](#multifactor-authentication-for-per-user-multifactor-authentication-users)
8151
- [Multifactor authentication and reauthentication for risky sign-ins](#multifactor-authentication-and-reauthentication-for-risky-sign-ins)
82
−- [Require phishing resistant authentication for admins](#require-phishing-resistant-authentication-for-admins) (Baseline security mode policy)
52
+- [Block access for high-risk users](#block-access-for-high-risk-users)
8353
8454
### Block all high risk agents from accessing all resources (Preview)
8555
86
−This policy blocks agent identities that are determined as 'high risk' from accessing resources in your tenant. The agent risk level is based on detections from [Microsoft Entra ID Protection for agents](/entra/id-protection/concept-risky-agents).
56
+This policy blocks agent identities that are determined as 'high risk' from accessing resources in your tenant. The agent risk level is based on detections from [Microsoft Entra ID Protection](/entra/id-protection/concept-risky-agents).
8757
8858
### Block legacy authentication
8959
⋯ 33 unchanged lines
12393
To apply this policy to more users, duplicate it and change the assignments.
12494
12595
> [!TIP]
126
−> Using the **Edit** pencil at the top to modify the Microsoft-managed per-user multifactor authentication policy might result in a **failed to update** error. To avoid this issue, select **Edit** under the **Excluded identities** section of the policy instead.
96
+> Using the **Edit** pencil at the top to modify the Microsoft-managed per-user multifactor authentication policy might result in a **failed to update** error. To work around this issue, select **Edit** under the **Excluded identities** section of the policy.
12797
12898
### Multifactor authentication and reauthentication for risky sign-ins
12999
⋯ 10 unchanged lines
140110
141111
To prevent attackers from taking over accounts, Microsoft blocks risky users from registering for multifactor authentication.
142112
143
−### Require phishing resistant authentication for admins
144113
145
−Accounts that are assigned specific privileged administrative roles are frequent targets of attackers. Requiring phishing-resistant MFA on those accounts is an easy way to reduce the risk of those accounts being compromised. For more information on this policy, see [Require phishing resistant authentication for admins](policy-admin-phish-resistant-mfa.md).
114
+### Block access for high-risk users
146115
147
−This policy is a [Baseline security mode](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) policy from Microsoft 365.
116
+This policy helps protect your organization by restricting access for users identified as high risk by Microsoft Entra ID Protection. User risk represents the likelihood that a user account has been compromised, based on signals such as leaked credentials or other risk detections. When enabled, this policy blocks access for users who meet the configured high user risk level until the risk is remediated. Remediation follows existing Microsoft Entra ID Protection processes and guidance.
148117
149
−## Upgrade from security defaults
118
+This policy targets:
150119
151
−When organizations [disable security defaults](../../fundamentals/security-defaults.md#disabling-security-defaults) to adopt Conditional Access, Microsoft automatically creates managed policies in the tenant to maintain the same protections. These policies ensure there's no gap in security coverage during the transition.
120
+- Organizations with Microsoft Entra ID P2 licenses
121
+- Organizations where security defaults aren't enabled
152122
153
−The following managed policies are created as part of the upgrade:
123
+Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.
154124
155
−| Upgrade policy | Similar Microsoft-managed policy | Notes |
156
−| --- | --- | --- |
157
−| Block legacy authentication | [Block legacy authentication](#block-legacy-authentication) | Same scope. Blocks sign-in attempts from clients using legacy authentication protocols. |
158
−| Require multifactor authentication for Azure management | *No equivalent* | Unique to the security defaults upgrade. Requires MFA for all users accessing Azure Resource Manager services, including the Azure portal, Microsoft Entra admin center, Azure PowerShell, and Azure CLI. |
159
−| Require multifactor authentication for admins | [Multifactor authentication for admins accessing Microsoft Admin portals](#multifactor-authentication-for-admins-accessing-microsoft-admin-portals) | Broader scope. Requires MFA for privileged admin roles signing in to *all applications*, not just admin portals. Also includes Authentication Policy Administrator and Identity Governance Administrator roles. |
160
−| Require multifactor authentication for all users | [Multifactor authentication for all users](#multifactor-authentication-for-all-users) | Same scope. Requires MFA for all users in the organization. |
125
+## Security defaults policies
161126
162
−## Monitor and review
127
+The following policies are available for when you upgrade from using security defaults.
163128
164
−To see the effect of these policies on your organization and investigate changes to the policies, you have a few options.
129
+- [Block legacy authentication](#block-legacy-authentication)
130
+- [Require multifactor authentication for Azure management](#require-multifactor-authentication-for-azure-management)
131
+- [Require multifactor authentication for admins](#require-multifactor-authentication-for-admins)
132
+- [Require multifactor authentication for all users](#require-multifactor-authentication-for-all-users)
165133
166
−### Policy impact
134
+### Block legacy authentication
167135
168
−Select the **Policy impact** tab of the managed policy from within Conditional access to see a summary of how the policy affects your environment. Adjust the filter, data format, and more to explore the policy's effect, even on report-only policies.
136
+This policy blocks legacy authentication protocols from accessing applications. Legacy authentication refers to an authentication request made by:
169137
170
−:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact.png" alt-text="Screenshot showing the effect of a policy on the organization.":::
138
+- Clients that don't use modern authentication (for example, an Office 2010 client)
139
+- Any client that uses older mail protocols such as IMAP, SMTP, or POP3
140
+- Any sign-in attempts to use legacy authentication.
141
+
142
+Most observed compromising sign-in attempts come from legacy authentication. Because legacy authentication doesn't support multifactor authentication, attackers can bypass multifactor authentication requirements by using older protocols.
171143
172
−### Sign-in logs
144
+### Require multifactor authentication for Azure management
173145
146
+This policy covers all users when they're trying to access various Azure services managed through the Windows Azure Service Management API including:
147
+
148
+- Azure portal
149
+- Microsoft Entra admin center
150
+- Azure PowerShell
151
+- Azure CLI
152
+
153
+Users must complete multifactor authentication to access these resources.
154
+
155
+### Require multifactor authentication for admins
156
+
157
+This policy applies to users with highly privileged admin roles:
158
+
159
+[!INCLUDE [conditional-access-admin-roles](../../includes/conditional-access-admin-roles.md)]
160
+
161
+These accounts must use multifactor authentication to sign in to any application.
162
+
163
+### Require multifactor authentication for all users
164
+
165
+This policy applies to all users in your organization and requires multifactor authentication for every sign-in. In most cases, sessions persist on devices, so users don't need to complete multifactor authentication when interacting with other applications.
166
+
167
+## Monitor and review
168
+
169
+The managed policy and the sign-in logs are the two places where you can see the effect of these policies on your organization.
170
+
171
+Review the **Policy impact** tab of the managed policy to see a summary of how the policy affects your environment.
172
+
173
+:::image type="content" source="media/managed-policies/microsoft-managed-policy-impact-on-sign-in.png" alt-text="Screenshot showing the effect of a policy on the organization.":::
174
+
174175
Analyze the **Microsoft Entra sign-in logs** to see details about how the policies affect sign-in activity.
175176
176177
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).
⋯ 7 unchanged lines
184185
- To investigate further, select the **Policy Name** to drill down into the configuration of the policies.
185186
1. Explore the other tabs to see the **client user** and **device details** that were used for the Conditional Access policy assessment.
186187
187
−### Audit logs
188
−
189
−The **Microsoft Entra audit logs** are helpful when investigating changes made to a policy.
190
−
191
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](~/identity/role-based-access-control/permissions-reference.md#reports-reader).
192
−1. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**.
193
−1. Set the **Service** filter to **Conditional Access**.
194
−1. If needed, select a specific **Activity** filter.
195
−
196
−The **Target(s)** column displays the name of the policy that was updated. Microsoft-managed policy names start with **Microsoft-managed**.
197
−
198
−The **Initiated by (actor)** column indicates who made the change. For Microsoft-managed policies, the value can be either **Microsoft Managed Policy Manager** or a user from your organization. Some changes to Microsoft-managed policies must be initiated or enabled by an administrator.
199
−
200188
## Common questions
201189
202190
### What is Conditional Access?
⋯ 33 unchanged lines
236224
### How do I monitor when Microsoft makes a change to these policies or adds a new one?
237225
238226
Administrators with **AuditLog.Read.All** and **Directory.Read** permissions can query the audit log for entries initiated by **Microsoft Managed Policy Manager** in the **Policy** category. For example, use [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to find entries with this query string: `https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=initiatedBy/app/displayName eq 'Microsoft Managed Policy Manager' and category eq 'Policy'`.
239
−
240
−In the Microsoft Entra admin center, use the following filter to narrow the audit log results.
241
−
242
−- Category: Conditional Access
243
−- Filter: Target(s) = "Microsoft-managed"
244
−- Filter: Initiated by (actor) = "Microsoft Managed Policy Manager"
245
−
246
−Keep in mind that some activities on a Microsoft-managed policy might be initiated by a user, not the Microsoft Managed Policy Manager.
247227
248228
## Related content
249229
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.