2.1.3.3. Design for conditional access

💡 First Principle: Adaptive security, which dynamically evaluates real-time signals to make access decisions, is essential for protecting resources in a modern, zero-trust world where identity is the new perimeter.

Scenario: You need to design an access policy for sensitive corporate applications. This policy should require multi-factor authentication for any user attempting to access the application from an untrusted location (e.g., outside the corporate network) or from a non-compliant device.

Conditional Access policies are "if-then" statements. If a user meets certain conditions, then they must fulfill certain requirements to access a resource.

Core Components:

• Assignments: Specify who the policy targets—users, groups, or roles—and which cloud apps or actions are in scope.
• Conditions: Define the signals that trigger the policy. Common conditions include:
  • User risk (likelihood of compromised identity, from Azure AD Identity Protection)
  • Sign-in risk (suspicious sign-in behavior, from Azure AD Identity Protection)
  • Device platforms (Windows, iOS, Android, macOS)
  • Locations (trusted or untrusted IPs/regions)
  • Client apps (browser, mobile, legacy protocols)
  • Device state (compliant, hybrid Azure AD joined)
• Cloud apps or actions: Identify the specific applications or actions (e.g., accessing SharePoint, registering security info) the policy will protect.
• Grant/Session Controls: Define enforcement actions when conditions are met, such as:
  • Block access
  • Require multi-factor authentication (MFA)
  • Require compliant or hybrid-joined device
  • Require approved client app
  • Enforce application restrictions (e.g., limited web access)

⚠️ Common Pitfall: Creating a Conditional Access policy that inadvertently locks out all administrators. Always use the "What If" tool to test the impact of a policy before enabling it, and ensure you have an emergency access account ("break-glass" account) excluded from all policies.

Key Trade-Offs:

• Security vs. User Experience: A policy that requires MFA for every sign-in can be frustrating for users. A well-designed policy uses conditions (like location or device trust) to require MFA only when the risk is higher, balancing security with a smoother user experience.

Reflection Question: How does designing for Azure AD Conditional Access, by evaluating real-time signals and enforcing adaptive access decisions, fundamentally enable organizations to protect resources without hindering productivity, by dynamically responding to context like user risk, device health, and location?