3.3.1. Microsoft Entra Conditional Access
💡 First Principle: Conditional Access is a policy engine — not a simple on/off switch — that evaluates real-time signals (who the user is, what device they're on, where they're connecting from, which application they're accessing, and current sign-in risk) and then applies a specific control, such as requiring MFA, requiring a compliant device, or blocking access entirely.
Think "if this, then that": if a user signs in from an unfamiliar country and the application is highly sensitive, then require MFA and a compliant device — all configured declaratively, without writing code. This is the practical, everyday implementation of Zero Trust's "verify explicitly" principle from Phase 2.1.3.
⚠️ Exam Trap: Conditional Access is a policy engine with granular grant and session controls, not a single tenant-wide block/allow toggle — expect scenario questions describing specific conditions that must map to a specific grant control.
Reflection Question: A company wants to require MFA only when employees sign in from outside the corporate network, but not when they're on-site. Which Entra capability implements this, and what signal does it rely on?
