2.2.4. Conditional Access Policies
š” First Principle: Conditional Access provides adaptive access control based on signals. Instead of binary allow/deny, it evaluates conditions (who, what, where, when, how) to make dynamic access decisions.
Scenario: Employees accessing Azure from corporate devices on the internal network should have seamless access. Those accessing from personal devices or unusual locations should require MFA.
Conditional Access Signals
- User or group membership: Who is accessing
- Cloud application: What they're accessing
- Device platform: Windows, iOS, Android, macOS
- Device state: Compliant, Hybrid Entra joined
- Location: IP ranges, named locations, countries
- Client application: Browser, mobile app, desktop client
- Sign-in risk: Real-time risk detection
- User risk: Historical risk patterns
Conditional Access Controls (Actions)
| Control | Effect | Use Case |
|---|---|---|
| Block access | Deny access entirely | Untrusted locations |
| Require MFA | Additional verification | Sensitive apps |
| Require compliant device | Must meet compliance policies | Corporate data access |
| Require Hybrid Entra join | Must be domain-joined | On-premises integration |
| Require approved client app | Only allowed apps | Mobile access |
| Require app protection policy | Intune app protection | BYOD scenarios |
Visual: Conditional Access Decision Flow
ā ļø Exam Trap: Creating Conditional Access policies without an exclusion for emergency access accounts. If a policy blocks all access and you're locked out, you need break-glass accounts excluded from all policies.
Key Trade-Offs:
- Granular Policies vs. Management Overhead: More policies provide precise control but are harder to manage
- Strict Controls vs. User Productivity: Requiring MFA everywhere is secure but impacts user experience
Reflection Question: Your organization wants to allow access to Azure from any location but require MFA for access outside the corporate network. How would you structure your Conditional Access policies?
