Conditional Access
noun · also CA policy, Conditional Access policy
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.
Conditional Access evaluates every sign-in to Microsoft Entra ID against a set of policies. Each policy has assignments (which users, which apps, under which conditions such as location, device platform or sign-in risk) and controls (block, or grant access only if the user satisfies MFA, uses a compliant device, accepts terms of use, and so on).
The idea is simple: instead of one rule for everyone, access depends on context. A sign-in from a managed laptop in the office can be smooth, while the same account signing in from an unknown device in another country has to prove more.
Example
A common baseline policy requires MFA for all users on all cloud apps, with a second policy that blocks legacy authentication protocols, which cannot do MFA at all. A stricter policy can require phishing-resistant methods for administrators.
Why it matters for a SOC analyst
The ConditionalAccessStatus field in sign-in logs tells you whether policies applied (success), blocked the sign-in (failure) or did not apply at all (notApplied). A suspicious sign-in where no policy applied is often the most important finding of an investigation, because it points to a gap that attackers will use again.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Tutorials · · 4 min read
Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Related terms
- Multi-factor authentication
Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.
- Phishing-resistant MFA
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- MFA fatigue
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
- Adversary-in-the-middle phishing
Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.