/glossary/entra-id/conditional-access
What is Conditional Access in Microsoft Entra ID?
- tool
- Microsoft Entra ID
- versions
- Microsoft Entra ID P1 / P2
- os
- any
Conditional Access is the policy engine of Microsoft Entra ID. Each policy is an if-then statement: if a sign-in matches the assignments (who, which app, from where, on which device, with what risk), then apply the access controls (block, or grant with requirements such as MFA or a compliant device). Policies are evaluated after the first factor (for example the password) succeeds, for browsers, desktop apps and PowerShell modules alike.
Parts of a policy
| Part | Examples |
|---|---|
| Users, groups, agents | All users, a group of admins, guests; exclusions such as break-glass accounts |
| Target resources | All resources, Office 365, Microsoft Admin Portals, a specific enterprise app |
| Network | Named locations: trusted IP ranges, countries or regions |
| Conditions | Sign-in risk, user risk, device platforms, client apps (for example legacy authentication), filters for devices |
| Grant controls | Block access, or require MFA, authentication strength, compliant device, hybrid joined device, approved client app, app protection policy, password change, terms of use |
| Session controls | Sign-in frequency, persistent browser session, app enforced restrictions, Defender for Cloud Apps |
Common policies: require MFA for administrative roles, block legacy authentication, require managed devices for sensitive apps, block sign-ins from countries where the organization does not operate.
Report-only mode
A policy can be On, Off or Report-only. Report-only policies are evaluated and logged in the sign-in logs but not enforced, so you can see who would be affected before turning a policy on.
How it looks to an admin running PowerShell
Admin modules sign in through Entra ID, so Conditional Access applies to Connect-ExchangeOnline, Connect-MgGraph, Connect-MicrosoftTeams and Connect-SPOService. Typical results:
| Code | Meaning |
|---|---|
| AADSTS50076 | MFA is required (for example by a policy); complete it in the interactive prompt |
| AADSTS53000 | The policy requires a compliant device and this device is not compliant |
| AADSTS53003 | Access blocked by a Conditional Access policy |
The Conditional Access tab of each sign-in in Monitoring and health > Sign-in logs shows which policies applied and their result. See AADSTS53003 in Connect-ExchangeOnline for a worked case.
Licensing and defaults
Conditional Access requires Microsoft Entra ID P1 (risk-based conditions need P2). Tenants without it can use security defaults, a fixed baseline that among other things requires MFA registration and blocks legacy authentication; security defaults and Conditional Access policies are not used together.
Sources
- learn.microsoft.comlearn.microsoft.com/en-us/entra/identity/conditional-access/overview
- learn.microsoft.comlearn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies
- learn.microsoft.comlearn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
- learn.microsoft.comlearn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-report-only
- learn.microsoft.comlearn.microsoft.com/en-us/entra/fundamentals/security-defaults