Microsoft Entra ID Conditional Access

What is Conditional Access?

Conditional Access in Microsoft Entra ID is a security feature that controls access to applications and data based on specific conditions.

It helps enforce policies like:

• Require MFA
• Block access
• Allow access only from trusted devices or locations

👉 In simple terms: Conditional Access ensures the right people access the right resources under the right conditions.

How does Conditional Access Work?

Conditional Access works using IF → THEN logic:

• If (Conditions are met)
  (e.g., user, location, device, app)
• Then (Apply controls)
  (e.g., require MFA, block access)

Flow:

• User attempts to sign in
• Conditions are evaluated
• Access is granted, blocked, or challenged

Key Features of Conditional Access

• User & Group Targeting – Apply policies to specific users or roles
• Location-Based Access – Allow/block based on IP or geography
• Device Compliance Checks – Require managed or compliant devices
• Application Control – Protect specific apps (e.g., Exchange, SharePoint)
• MFA Enforcement – Require multi-factor authentication

Use Cases for Conditional Access

• Enforce MFA for Admins
• Block Sign-ins from Unknown Locations
• Allow Access Only from Corporate Devices
• Secure Access to Sensitive Applications
• Restrict Access Based on Risk Levels

Fetching Conditional Access Policies Using PowerShell

Get-MgIdentityConditionalAccessPolicy

Retrieves all Conditional Access policies in Microsoft Entra ID.

Creating Conditional Access Policies Using PowerShell

Creating policies typically involves defining conditions and controls using a JSON body.

Example:

$params = @{
    displayName = "Require MFA for Admins"
    state = "enabled"
    conditions = @{
        users = @{
            includeRoles = @("Global Administrator")
        }
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("mfa")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $params
                                        

This creates a new App Registration with the specified name.

Frequently Asked Questions

1. Is Conditional Access part of Azure AD or Entra ID?
   It is part of Microsoft Entra ID (formerly Azure AD).
2. Does Conditional Access replace MFA?
   No, it enforces when MFA should be applied.
3. Can Conditional Access block access completely?
   Yes, policies can fully block sign-ins based on conditions.
4. Is Conditional Access applied to all users by default?
   No, it must be configured and targeted explicitly.