Identity and security
CA
Conditional Access
Conditional Access is Microsoft Entra ID's policy engine for making real-time access decisions. It evaluates signals about who is signing in, from what device, from where, into which application, and at what assessed risk level, then applies a grant control before the sign-in is allowed to complete.
Why CA matters in a Microsoft estate
CA matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How CA shows up in practice
A policy is built from an if-then structure: assignments define the conditions under which it applies, such as a specific group of users, a specific set of cloud apps, a named location, or a device platform. Grant controls define what must additionally be satisfied, such as requiring multifactor authentication, requiring a compliant or hybrid-joined device, requiring an approved client app, or blocking access outright. Session controls can further restrict what happens after access is granted, such as limiting app functionality through Conditional Access App Control or forcing frequent reauthentication for sensitive apps. This is what makes Conditional Access the practical enforcement layer of a Zero Trust posture.
Rather than trusting a session simply because it presented a valid password, every sign-in is re-evaluated against current context. Identity Protection's risk signals can feed directly into policy, automatically requiring stronger verification or blocking sign-in entirely when a user or sign-in is flagged as risky. In practice, the two things that most commonly go wrong are policy conflicts and scope gaps. Overlapping policies with contradictory controls can produce unexpected blocks or unintended bypasses, and it is disturbingly easy to build a policy that technically applies to 'all users' but inadvertently excludes a service account, a break-glass account, or a legacy authentication path that still bypasses modern authentication entirely. This is exactly the kind of gap attackers look for.
Because a misconfigured policy can lock out an entire tenant, including its own administrators, maintaining at least one emergency-access 'break-glass' account excluded from Conditional Access, with a long, closely guarded credential, is standard practice rather than an optional precaution. New or modified policies should generally be rolled out in report-only mode first, so their real-world impact on existing sign-ins can be reviewed before enforcement begins. Conditional Access itself requires an Entra ID P1 licence or equivalent bundled entitlement. It sits alongside Multifactor Authentication, device compliance from Intune, and Identity Protection's risk detections as one of the core building blocks that turns identity, rather than the network perimeter, into the primary control point for access decisions.