Conditional access

As explained in Azure Security

A conditional access policy is a Microsoft Entra access rule that evaluates assignments and conditions to apply access controls.

Conditional access applies different security policies according to the access scenario. It combines identity, application, location, device, and risk information to control access to Azure services and applications. This supports layered identity protection beyond standalone MFA or identity protection policies. section 2.2.7 section 2.14

Build a conditional access policy from three elements:

• Assignments identify the users, groups, workload identities, and cloud applications or actions covered by the policy. section 2.2.7
• Conditions evaluate factors such as sign-in risk, IP location, device information, and application context. section 2.2.7
• Controls block access or grant access with safeguards such as requiring multifactor authentication. section 2.2.7

Require MFA for Azure management tasks

In the Azure portal, open Azure Active Directory > Security > Conditional Access and create a policy for Bob. Select Microsoft Azure Management under Cloud Apps or Actions, exclude trusted locations, and grant access while requiring MFA. Set the policy to Report-Only so its effects can be evaluated before switching it to On. A related exercise requires MFA when sign-in risk is medium or high. section 2.2.8 section 2.12

Figure 2.8 A simplified view of how conditional access in Azure AD works

Use the simplified flow to connect assignments and conditions with the resulting access controls. section 2.2.7

Figure 2.9 Configuring a conditional access policy in the Azure portal

Use the portal configuration view to follow the policy setup and locate its principal options. section 2.2.8

How Azure Security covers it

How deep it goes

Descends through assignments, conditions, controls, and portal configuration, while stopping short of command-line implementation.

Examples

Demonstrates MFA for Azure management tasks, trusted-location exclusions, report-only evaluation, and medium-or-high sign-in-risk policies.

What it assumes

Requires a conditional access administrator role and Azure AD Premium P1; risk-based policies require Premium P2 coverage.

What you can do after

Operate/configure a report-only or enforced MFA policy for selected users and Azure management actions.

How it connects

Connects Azure MFA, identity protection, security defaults, trusted locations, Azure RBAC, and identity governance.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Microsoft Azure in ActionConditional Access is a Microsoft Entra access-control capability that applies policies based on identities, applications, devices, locations, and other conditions.

Compare how 2 books explain conditional access →

Related concepts

• multifactor authenticationconfigures · Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.
• conditionpart of · A condition is a contextual boolean requirement that determines whether an authorization policy or access requirement applies.
• dynamic evaluationuses · Dynamic evaluation is runtime evaluation in which executable content or decision criteria are determined from current values or context.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.