An access policy is a defined set of rules that determines an outcome: who may access a service or resource, and under what conditions. In Azure, “policy” means rules that must be obeyed—not merely friendly advice. section 6.5
A conditional access policy usually brings together:
- A name that identifies the policy. section 6.5
- Users or groups affected by the rule; broad groups make general policies simpler to manage. section 6.5
- An access grant that states the required condition, such as multi-factor authentication. section 6.5
- Optionally, a target application or other authentication condition. section 6.5
Making MFA a house rule
Suppose Alpaca-Ma-Bags wants every Entra ID user to use MFA. Create a conditional access policy, select the broad user group, and add a grant requiring multi-factor authentication before access is allowed. New users added to that group inherit the rule, reducing manual maintenance. Azure Entra ID requires Premium P1 or an equivalent tier for this configuration. section 6.5
