Try out our unique Conditional Access editor for FREE!

Conditional Access is a capability within Microsoft Entra identity management that controls user access to company apps and data based on other factors, such as device state, location, risk levels and other contextual signals. 

It is the centerpiece of Zero Trust security, a model that does not grant access just because a user knows their username and password. 

Instead Conditional Access ensures additional security checks are passed before access is granted, such as requiring that a user is signing in from a company managed device that is also security compliant, and enforcing stronger MFA in particular circumstances.

We can scope Conditional Access policies in a number of ways, here we consider Baseline policies that are active across a whole Microsoft Tenant for all users, and Persona based policies, that are targeted at a specific set of users based on their role within the company, for example corporate staff in a given country or managers of a retail environment.

Baseline policies are relatively easy to implement- there are a number of Microsoft templates straight out-of-the box that can be implemented with little or no configuration changes.

 Persona based polices, on the other hand, require more complex analysis and provide an enhanced layer of security.

Note that Conditional Access only has control over those resources to which Microsoft Entra is the Identity Provider (IdP), for example Office365 or Azure portal access.

 Understanding and defining expected access requirements for the various roles in a business (Personas) is a foundational strategy in identity and access management, playing a critical role in supporting a Zero Trust security framework.

With a well defined approach, Personas can be directly mapped into Conditional Access policies.

This example persona describes a UK retail store manager. They are:

• issued with a corporate laptop that is enrolled into Intune
• able to use their personal phone to access company Microsoft O365 services
• have access to a store manager App
• able to log into the Point of Sale (POS ) device, an Intune managed iPhone
• based in any UK store

We employ Microsoft's App Protection Policy with Grant actions to strengthen the security around using personal mobile devices to access corporate data.

Each Persona is built by understanding business operations

and ensuring they align with best security practice.

When conducting a Persona assessment, the following, as a minimum should be taken into account:

• Microsoft licenses assigned to users
• Groups assigned to users
• User types, such as Member, Guest, Federated, External
• Resources and resource types accessed by users
• Platforms / hardware assigned to the users 
• Device enrollment mechanisms / if the devices are company or personally owned
• On-prem Entra hybrid joined devices that may be in use
• Locations / network the users will be working in
• Client types that are used, such as browser, client and mobile apps
• Compliance of the devices that should be achieved
• App Protection Policies that may be deployed
• Password policies relevant to the user types
• The type and strength of MFA that is required
• Session security requirements, such as periodic authentication
• Global Secure Access (Microsoft's new secure cloud access)

A risk based approach can also be added, that determines access based on a user's activity risk or sign-in risk, adding another layer of security.

Note that the Actions are only performed if ALL of Users, Resources and Conditions, that have an entry in their corresponding blue box, are matched TRUE; otherwise the policy has no effect.

This is the key to understanding Conditional Access.