What is Conditional Access in Microsoft Entra ID?

Conditional Access is Microsoft Entra ID's zero-trust policy engine. It evaluates each sign-in attempt against configured policies and enforces appropriate access controls.

How it works: 1. User attempts to sign in 2. Entra ID evaluates all applicable policies 3. If conditions match, controls are enforced 4. User must satisfy controls to gain access

• *Signal types (conditions):
• User/Group: Target specific users, groups, or roles
• Cloud apps: Which applications the policy applies to
• Device platform: Windows, macOS, iOS, Android, Linux
• Location: Named locations, IP ranges, countries
• Device state: Compliant, Hybrid Azure AD joined
• Sign-in risk: Real-time risk level (requires Entra ID P2)
• User risk: Overall user risk level

• *Access controls (grants):
• Require MFA
• Require compliant device
• Require Hybrid Azure AD joined device
• Require approved app
• Require app protection policy
• Block access
• Require password change

Common policies: 1. Require MFA for all users 2. Block legacy authentication 3. Require compliant devices for corporate apps 4. Block access from untrusted locations 5. Require MFA for admin roles

TrueConfig monitors Conditional Access configurations across CA-01 through CA-11 controls.