2.5.5. 💡 First Principle: Microsoft Entra Conditional Access
First Principle: Conditional Access is the intelligent policy engine that brings together identity signals to make access decisions and enforce organizational policies. Its core purpose is to move beyond simple "allow or deny" to contextual access control—granting access based on who, what, where, when, and how a sign-in occurs.
Traditional security asked: "Do you have the right password?" Conditional Access asks: "Is this the right person, on a trusted device, from a safe location, accessing appropriate resources?" It's the decision point that evaluates risk and enforces appropriate controls.
How It Works:
Conditional Access policies follow an "if-then" logic:
- IF a user matches certain conditions (user/group, app, location, device state, risk level)...
- THEN apply specific controls (allow, block, require MFA, require compliant device, limit access)
Common Policy Scenarios:
| Scenario | IF (Condition) | THEN (Control) |
|---|---|---|
| Require MFA for admins | User is in Admin role | Require MFA |
| Block risky sign-ins | Sign-in risk is High | Block access |
| Require managed devices | Accessing sensitive apps | Require compliant device |
| Allow trusted locations | Accessing from corporate network | Allow without MFA |
Key Signals Used:
- User or group membership: Target specific users or roles.
- IP location: Corporate network vs. unknown location.
- Device state: Compliant, Entra joined, or unmanaged.
- Application: Which app is being accessed.
- Real-time risk: Microsoft's identity protection risk assessment.
Scenario: A financial institution wants to allow employees to access sensitive financial applications from the office without MFA, but require MFA when accessing from home. If a sign-in is detected from an unusual country, access should be blocked entirely.
Reflection Question: How does Conditional Access enable this organization to apply different security controls based on the context of the sign-in, rather than using a one-size-fits-all approach?
💡 Tip: Conditional Access is the enforcement point for Zero Trust. It evaluates signals and decides what controls to apply—it's not just MFA, but a complete policy framework for access decisions.
