2.2.1. Policy Anatomy: Assignments and Controls
💡 First Principle: Every CA policy is three lists: who (users and groups, with exclusions), what (target resources — cloud apps, user actions, or authentication context), and under which circumstances (conditions) — resolved into what to demand (grant controls) and how the session behaves (session controls). If you can parse a stem into those slots, you can answer it.
Assignments. Users: include all users / groups / roles / external user types; always exclude break-glass accounts and (usually) service accounts. Target resources: specific apps, all cloud apps (careful — includes the portals), user actions (the two special ones: register security information and register or join devices), or authentication context (2.2.3). Conditions: sign-in risk and user risk (feeds from 2.3), device platforms, named locations (IP ranges/countries you define; mark trusted), client apps (the lever that blocks legacy authentication — protocols that can't do MFA), and filter for devices (rule-based device targeting, e.g., isCompliant, model, extensionAttributes).
Grant controls demand proof: require MFA, require authentication strength (a named set of acceptable methods — e.g., phishing-resistant MFA), require compliant device (Intune), require Entra hybrid joined device, require approved client app / app protection policy, require password change, require terms of use. Multiple selected controls combine with AND or OR per your choice. Block overrides everything.
Baseline policy set Microsoft (and the exam) expects: require MFA for admins; block legacy authentication; require MFA (or strength) for all users on unfamiliar conditions; require compliant devices for sensitive apps; secure the register security information action.
⚠️ Exam Trap: "All cloud apps" quietly includes the very portal you manage CA with — pair it with correct exclusions and a tested break-glass path, or a bad condition locks the admins out too.
Reflection Question: A policy requires either compliant device or MFA; another matching policy requires MFA outright. What must a user on an unmanaged laptop actually satisfy, and why?
