TL;DR (for those of us short on time)
- Conditional Access is the policy engine of Microsoft Entra ID. At every sign-in it checks who is coming in, from where, on which device and to which application, and decides whether to let them in, ask for more or block.
- It works with rules of the form “if this happens, then require that”. For example: if someone wants to get into Microsoft 365, they have to pass multifactor authentication (MFA).
- It is evaluated after the person passes first-factor authentication. It is a decision layer, not a front-line defence.
- If no policy applies to a sign-in, access is granted. Whatever no policy covers is allowed.
- It needs Microsoft Entra ID P1, which Microsoft 365 Business Premium includes. Without that licence there are security defaults, which cannot be combined with Conditional Access.
- Before turning anything on: an emergency account excluded and the policy in report-only mode.
What Conditional Access is
Conditional Access is the part of Microsoft Entra ID that decides what each person trying to sign in has to do. Microsoft presents it as its Zero Trust policy engine: it brings signals together, makes a decision and enforces it.
A Conditional Access policy is, in essence, a sentence with a condition. If a user wants to access a resource, then they have to complete an action. The example in Microsoft’s documentation is the most common one: if someone wants to get into a service such as Microsoft 365, they have to do multifactor authentication.
For an SME, it is the tool that moves you from “anyone gets in from anywhere with a username and password” to “people get in with MFA, from known devices, and what makes no sense is blocked”. It is also where decisions that used to be scattered end up together: who needs what, from where and with which guarantees.
How it works: signals, decision and enforcement
Each policy has two halves. The assignments say who it applies to, which resources and under which conditions. The access controls say what happens when all of that is met.
| Part of the policy | What it can include |
|---|---|
| Signals (who and when) | User, group or agent (agents are in preview). IP location, with your own ranges or whole countries and regions. Device, by platform, state or filters. Application. Sign-in or user risk, through Microsoft Entra ID Protection. Microsoft Defender for Cloud Apps. |
| Decision | Block access, which is the most restrictive, or grant it requiring one or more of: MFA, a given authentication strength, a device marked as compliant, a Microsoft Entra hybrid joined device, an approved client app, an app protection policy, a password change or acceptance of terms of use. |
| Session controls | App enforced restrictions, Conditional Access App Control, sign-in frequency, persistent browser sessions and customised continuous access evaluation. |
You do not have to use all of it. The most useful policies to start with combine few signals with a simple decision, such as requiring MFA for administrators or blocking legacy authentication protocols.
When it applies, and what happens to what it does not cover
Conditional Access policies are enforced once first-factor authentication is completed. Microsoft says so explicitly: it is not intended as a front-line defence against attacks such as denial of service, although it can use signals from those events to decide.
The access token is issued by default when no condition triggers a control. If one policy requires MFA for users in the Finance group to reach the payroll application, someone who is not in Finance gets in without MFA. Preventing that takes another policy that blocks everyone else.
That is why Microsoft recommends that every application has at least one policy. The easiest way is a policy that includes “all resources” (formerly “all cloud apps”), so that new applications are covered without touching anything.
What it solves for an SME
These are the uses Microsoft lists as common. They can be created from scratch, from the portal templates or through Microsoft Graph:
- Require MFA for users with administrative roles.
- Require MFA for Azure management tasks.
- Block sign-ins that use legacy authentication protocols.
- Require trusted locations to register security information.
- Allow or block access from certain locations.
- Block risky sign-in behaviours.
- Require organisation-managed devices for certain applications.
It is also the piece that enforces strong methods. With it you can require phishing-resistant methods for privileged roles, which is where the manual on passkeys in Entra ID and the retirement of SMS and voice calls fit in.
Licences
| What you want to do | What you need |
|---|---|
| Conditional Access policies | Microsoft Entra ID P1. Microsoft 365 Business Premium also includes it, as do the E3 and E5 enterprise plans. |
| Risk-based policies (sign-in and user risk) | Microsoft Entra ID P2, through Microsoft Entra ID Protection. |
| Basic protection without those licences | Security defaults, available to all customers. Creating Conditional Access policies prevents you from enabling them, so they are not combined. |
Features that interact with Conditional Access, such as Intune, Purview or Workload ID, require their own licence. And if the Conditional Access licences expire, the policies are not disabled or deleted automatically: you can view and delete them, but no longer edit them.
Where it is configured
In the Microsoft Entra admin center, under Entra ID > Conditional Access. Any administrator with at least the Security Reader role can go in and look. There are three places worth knowing:
- Overview: a summary of recent activity, with how many policies are on and how many in report-only mode.
- Coverage: which applications did and did not have a policy over the past seven days. It helps find the ones left exposed.
- Policies: the list of all policies in the tenant and the What If tool, which simulates a sign-in to show which policies would apply.
To create, modify or restore deleted policies you need the Conditional Access Administrator role.
Before creating the first policy
Conditional Access can lock the whole company out with a single badly configured policy. Four precautions that Microsoft recommends and that cost nothing:
- Exclude the emergency access accounts from all policies. If a policy is misconfigured and all administrators are blocked, that account is the way back in.
- Start in report-only mode. The policy records in the sign-in logs what it would have done without enforcing it. Policies created from a template start that way, and Microsoft recommends keeping them at least a week before turning them on.
- Test with a pilot group, check the exclusions too and tell users what changes and how to get help.
- Do not combine block and “all resources” in one policy without thinking: it can lock out administrators, and there are endpoints, such as Microsoft Graph, for which exclusions cannot be configured.
Each tenant supports a maximum of 240 Conditional Access policies, counting those that are on, off or in report-only mode. It is better to group applications with the same requirements into one policy than to create one per application.
What comes next in this series
This is the first article in a series on Conditional Access. In the next ones I will get practical: the baseline policies for an SME, how to roll them out without blocking anyone using report-only mode and the What If tool, and how to diagnose a block with the sign-in logs.
If your company already has Microsoft 365 Business Premium and this part has never been touched, you are paying for a tool you do not use. When you want to put it in order, there is the Microsoft security service.
Any questions, I am here. No smoke.
Microsoft Entra Conditional Access: Zero Trust Policy Engine — Microsoft Learn · Plan Your Microsoft Entra Conditional Access Deployment — Microsoft Learn · Security defaults — Microsoft Learn · Manage emergency access accounts — Microsoft Learn
Last verified: 5 November 2026, against Microsoft Learn (overview, updated 27 April 2026, and planning, updated 1 June 2026). Option names in the portal may vary with the language and with Microsoft’s changes.