Azure Conditional Access is Microsoft’s Zero Trust policy engine. It uses an If-Then logic to make real-time decisions about granting or blocking access to resources. It takes various signals (like user risk, location, device type) and enforces actions (like Multi-Factor Authentication or device compliance).
🛡️ The Conditional Access Framework
A Conditional Access policy is built on the following structure:
Component Description Example
Assignments (The IF condition) Defines who is affected and what they are trying to access. If the User is in the Admins group and they are accessing the App Azure Management Portal…
Conditions (The AND conditions) Specifies the environment requirements for the access attempt. …AND the Location is Outside Corporate Network AND the Device is Not Compliant…
Access Controls (The THEN action) The required actions the user must complete to gain access, or the action to block access.
💡 Example Policy: Protecting Admin Accounts
This is one of the most critical policies every organization should implement.
Policy Goal: Ensure that anyone trying to use a highly privileged administrative account (Global Admin, Conditional Access Admin, etc.) must use Multi-Factor Authentication, regardless of their location, to prevent credential theft attacks.
Component Setting Configuration
Assignments
Users or workload identities Include Directory roles \rightarrow Select Global Administrator (and other admin roles).
Target resources Include Select All cloud apps.
Conditions
(None) Do not configure By leaving the conditions empty, this policy applies from any location, any device, and any client app.
➡️ What Happens During Access?
IF an account with the Global Administrator role attempts to sign into any app (e.g., Microsoft 365, Azure Portal, Teams).
THEN Microsoft Entra ID checks the policy.
The user is immediately prompted for Multi-Factor Authentication (a phone call, Authenticator app code, etc.), even if they are in the office or signed in 10 seconds ago.
If they pass MFA, Access is Granted. If they fail or cannot complete MFA, Access is Denied.
🌍 Example Policy: Blocking Untrusted Locations
This policy is often used to restrict access to corporate resources from known high-risk geographical areas.
Policy Goal: Block all sign-ins to core corporate resources if the user is attempting to access them from a country that your organization does not do business in
➡️ What Happens During Access?
- IF an account with the Global Administrator role attempts to sign into any app (e.g., Microsoft 365, Azure Portal, Teams).
- THEN Microsoft Entra ID checks the policy.
- The user is immediately prompted for Multi-Factor Authentication (a phone call, Authenticator app code, etc.), even if they are in the office or signed in 10 seconds ago.
- If they pass MFA, Access is Granted. If they fail or cannot complete MFA, Access is Denied.
🌍 Example Policy: Blocking Untrusted Locations
This policy is often used to restrict access to corporate resources from known high-risk geographical areas.
Policy Goal: Block all sign-ins to core corporate resources if the user is attempting to access them from a country that your organization does not do business in
