Conditional Access Policies

TL; DR

Conditional Access brings signals together to make authorisation decisions and enforce organisational policies.

Conditional Access policies work alongside Authentication Methods and integrate with comprehensive identity platforms like Microsoft Entra ID.

How It Works

Conditional Access evaluates signals during authentication to determine if access should be granted, blocked, or require additional verification.

Signal Types

User and Group Information

• User identity and group memberships
• User risk level (based on behavior analysis)
• Admin role assignments
• Guest vs member users

Location-Based Signals

• Geographic location (country, region)
• IP address ranges and named locations
• Trusted vs untrusted networks
• Travel patterns and anomalies

Device Signals

• Device compliance status
• Device platform (iOS, Android, Windows)
• Managed vs unmanaged devices
• Device risk assessment

Application Signals

• Specific applications being accessed
• Application sensitivity levels
• Data classification requirements
• Legacy vs modern authentication

Session Signals

• Sign-in frequency patterns
• Session duration requirements
• Application usage patterns
• Real-time risk assessment

Common Policy Examples

Multi-Factor Authentication Requirements

• Require MFA for all admin users
• Require MFA when accessing from untrusted locations
• Require MFA for high-risk applications

Device-Based Controls

• Block access from non-compliant devices
• Require managed devices for sensitive apps
• Allow personal devices with restrictions

Location-Based Controls

• Block access from specific countries
• Require additional verification for unusual locations
• Allow access only from corporate networks

Application-Specific Controls

• Require app protection policies for mobile access
• Block legacy authentication protocols
• Implement session controls for web applications

Implementation Strategy

Phase 1: Discovery and Planning

• Identify user groups and access patterns
• Map applications and their sensitivity levels
• Define security requirements and compliance needs

Phase 2: Policy Development

• Start with report-only mode
• Create policies for specific groups/scenarios
• Test policies thoroughly before enforcement

Phase 3: Gradual Rollout

• Begin with pilot groups
• Monitor user impact and feedback
• Gradually expand to broader populations

Phase 4: Optimisation

• Analyze policy effectiveness
• Adjust based on user behavior and security incidents
• Continuous monitoring and improvement

Best Practices

• Always test in report-only mode first
• Provide clear communication to users
• Have break-glass procedures for emergencies
• Regular policy reviews and updates
• Monitor for unintended access blocks

Integration with Zero Trust

Conditional Access is a key component of Zero Trust Architecture, providing dynamic access controls based on real-time risk assessment.