Conditional access is a security feature that allows organizations to control access to business resources based on certain conditions. Common reasons for using this technology include applying multi-factor authentication (MFA), requiring stronger authentication measures during login, and more. It's also one of the core features of Microsoft Entra ID, focused on controlling access for applications and identities in Microsoft 365 cloud services. In this article, we'll take a closer look at what Conditional Access in Entra ID is and how it works, and we'll try to understand its role in your company's security posture.
Microsoft Entra ID (formerly known as Azure Active Directory) is Microsoft's cloud-based identity and access management service. It helps manage and protect user identities, allows legacy or local identities to be synchronized with the cloud, and offers Single Sign-On (SSO) access to Infrastructure as a Service (IaaS) and Software as a Service (SaaS) applications.
Entra ID plays a crucial role in Microsoft's cloud architecture. It is the only identity provider that provides direct access to the most popular Microsoft applications, such as Microsoft 365 and Azure Cloud Services, which is why it is essential to correctly configure your Entra ID tenant.
Otherwise, the consequences can be serious. Over the past year, malicious actors have exploited misconfigurations of Entra ID in high-profile attacks, including the latest breach against Microsoft, in which the hacker group Midnight Blizzard gained access to one of Microsoft's Entra ID tenants through a password spraying attack aimed at users without MFA.
After the initial violation, the group abused the permissions of OAuth applications to access executive mailboxes and steal sensitive information. Violations of this type are preventable with adequate security checks on Entra ID.
Implementing a secure authentication system is a necessity for any organization. However, too many restrictions can make logging in not only secure, but also frustrating for users. To balance security and efficiency, Microsoft Entra ID uses Conditional Access policies to apply different levels of authentication, adapted to various conditions.
But what is conditional access, what is it for and how can it be implemented? Let's find out in the next sections.
Let's take a hypothetical scenario as an example: we are responsible for managing identities and accesses in a company based in a European country. The company has a hundred employees distributed across various departments and has a hybrid infrastructure that includes:
Based on this information, our task will be to implement a secure authentication strategy that takes into account the following aspects:
Basically, a lot of requirements that require the perfect balance between severity and simplicity. Not a particularly simple task.
Although it may seem complex, this is the reality of many companies today. Employees are working remotely around the world, with different roles and levels of access, which requires stricter strategies and methods to ensure authentication security than ever.
If, for example, an administrator logs in while on vacation on the other side of the world, their authentication process must necessarily be stricter than when working in the office.
To guarantee this flexibility to employees and address different security needs, it is essential to adopt a conditional access strategy (conditional access).
This allows you to customize security measures based on roles, geographical locations and applications, creating a robust and adaptable security framework.
But what exactly is it? Let's see it down here.
Conditional access is a security feature offered by Entra ID. This is provided to premium tenants P1 and P2, but is also available with Microsoft 365 Business Premium, M365 E3 + Security, and M365 E5 plans.
The feature allows organizations to control access to specific applications and resources based on defined criteria for login attempts. IT administrators can create multiple policies to manage the complexities and unique needs of their infrastructure.
The mechanism works by evaluating certain conditions at the time of access (known as access conditions), such as the location, time, or device used to make the request, and then applying security policies to ensure that access is granted only if it meets the predefined conditions.
It can be imagined as a security policy analysis engine that processes signals and attributes of incoming authentication and authorization requests, applying company policies to grant or deny access to resources based on these parameters.
The range of settings, conditions, and policies available allows you to create policies tailored to meet your organization's security and compliance needs.
Conditional access aligns with the fundamental principles of Microsoft's Zero Trust security model, according to which trust is never presumed and every attempt to log in is scrupulously verified.
When configured, conditional access acts as a security guardian, ensuring that authentication and access to resources comply with established authentication conditions and requirements.
A typical conditional access flow follows these steps:
The criteria behind conditional access help prevent unauthorized access to sensitive resources, improving the organization's security posture.
They are extremely versatile tools and apply to different scenarios, but they can be complex to configure.
Here are a few ways you can use conditional access controls to achieve your security and compliance objectives:
We have created the Infrastructure & Security team, focused on the Azure cloud, to better respond to the needs of our customers who involve us in technical and strategic decisions. In addition to configuring and managing the tenant, we also take care of:
With Dev4Side, you have a reliable partner that supports you across the entire Microsoft application ecosystem.
Recently, a series of big news have been announced and released that have affected Microsoft Entra ID and its Conditional Access features. Let's take a look at the main ones below.
We know how much Microsoft is increasingly integrating its Copilot into all its tools, and its security suites are no exception.
The integration of Security Copilot into the Microsoft Entra Admin Center will allow administrators to access the most advanced features of Redmond's AI assistant for managing identity security.
Key features include:
Microsoft announced the introduction of mandatory multi-factor authentication (MFA) for accessing the Microsoft Entra Admin Center, the Microsoft Azure Portal and the Microsoft Intune Admin Center.
In addition, other changes are planned, including the unification of 'Cloud apps' and 'Global Secure Access' under a single 'Resources' item, the automatic updating of the existing policy scheme and new options for managing MFA notifications, including integration with WhatsApp for some countries.
However, there is currently no official information available about these changes and we therefore recommend that you monitor Microsoft's announcements to confirm future updates.
Conditional access is determined by policies. Administrators can design and create policies for different usage scenarios, controlling who can access what and when. Based on established controls, policies determine whether or not a user can access a specific application or service.
At the base of their operation, they operate as' if-then 'statements. For example, if a user tries to log in to an application from an unknown or untrusted location, they will need to use multi-factor authentication (MFA) to gain access.
If, on the other hand, the user is logging in from one of the company locations, the MFA prompt may not be necessary.
Conditional access policies are comprised of two main sections:
To create a new policy in the Entra ID portal, log in as administrator and go to Security > Conditional Access > Create new policy.
Configure who is affected by the policy.
It is possible to include and exclude entities within the same policy. For example, a policy may include a specific group (such as privileged users) and exclude specific roles (such as Global Administrators) to ensure the highest possible level of granular access.
Four types of target resources can be protected by Conditional Access policies:
Six conditions may apply to a Conditional Access policy:
This allows or denies access to the tenant based on the configured assignments.
If the policy allows access, you can apply one or more security controls as additional access requirements.
These may include:
These controls manage session properties, such as duration, persistence, continuous access, and more, after successful authentication, and allow admins to implement properties such as:
Once you have finished configuring the relevant controls, you can apply one of the following operating modes:
As organizations grow, so do the use cases for access and each use case may require a dedicated policy, not to mention that these applicable policies must then be fulfilled at the same time.
At this point, you might find yourself managing dozens of policies and wondering: Are there duplicate policies? Are they evaluated correctly? Is there a logical error in configuring the policy that denies a crucial service? Are there any users blocked by mistake?
These are all valid concerns, so here are two simple methods for resolving any policy issues.
The Entra ID access logs provide details on which policies were evaluated during the login process and what their result was. To view the logs, we access Entra ID and go to Monitoring > Sign-in logs. We can click on each log and go to the tab Conditional Access to understand which policies have been evaluated and see the results.
We can use search filters to answer specific questions such as: “What policies have been evaluated for user X?” or “What policy is preventing user Y from logging in?”.
On the access logs page, click Add filters, choose Conditional Access and we apply.
By default, the new filter value will be set to None selected. Let's click on the new filter and select Failure.
Let's click on a specific failed login log and choose the tab Conditional Access. Let's select a specific policy line, then the three dots on the right side and finally Show details. The new page will help you understand why the result is Failure.
We don't necessarily have to wait for a scenario to occur to be able to understand if our policies are working or not. We can provoke it ourselves.
Before someone pulls out a laptop with Kali, however, let's specify that a very interesting feature of Entra ID is to be able to simulate a login event in order to verify the soundness of the policies that have been implemented with the function What if.
To do this, from the Entra ID console, let's go to Security > Conditional Access > Policy. Then we select What If.
In the new window, we can provide the tool with hypothetical login details. After filling in the details, we select What If and a new section will appear with two tabs: Policies that will apply and Policies that will not apply.
With the greater spread of remote work and the sudden increase in threats to digital security in recent years, having access policies that are flexible and strict at the same time is essential for all your business users.
Entra ID, with its conditional access features, offers exactly this apparently paradoxical combination and allows painstaking access control that takes into account every potential risk factor that could make these accesses potentially suspicious.
Getting to know this functionality thoroughly is essential for all Entra ID users. On the other hand, for those who are still undecided or do not know anything about the subject, we just have to invite these users to learn more about the topic Entra ID and to secure their corporate identities and digital assets as soon as possible.
Conditional Access is an Entra ID security feature that allows you to control access to business resources based on predefined conditions. It is based on policies that evaluate factors such as geographical location, the device used and the level of access risk to determine whether to grant or deny authentication.
Conditional Access offers protection against unauthorized access and allows multi-factor authentication to be applied only when necessary, avoiding unnecessary complications for users. It also allows you to customize access policies based on different parameters, such as the role, position and device used. Following Zero Trust principles, it guarantees strict control over every access attempt, helping to strengthen the organization's security.
To use Conditional Access, you must have an Entra ID Premium P1 or P2 license. It's also included in the Microsoft 365 Business Premium, M365 E3 + Security, and M365 E5 plans.
When a user attempts to access a business resource, Entra ID evaluates a series of conditions defined by policies. These may include the device used, the geographical location, the time of access and the level of risk associated with the user. If the established conditions are met, access is granted. Otherwise, an additional authentication step may be required or access may be denied.
Yes, you can configure policies that restrict access based on geographic location and IP addresses. For example, unrestricted access may be allowed to users who connect from corporate offices, while those accessing from a home network may be required to use multi-factor authentication. Access from countries considered to be at high risk can be completely blocked.
Yes, Conditional Access supports SaaS applications such as Microsoft 365, Salesforce and GitHub, in addition to workloads hosted on IaaS providers such as Azure. Administrators can create policies to ensure that only compliant users and devices can access these applications, thus improving the overall security of the business infrastructure.
If a user does not meet the conditions established by the policies, access to the resource may be denied or additional authentication, such as the use of MFA, may be required. In some cases, restrictions may apply to the session, such as the need to re-authenticate after a certain period of time.
Entra ID offers two tools for verifying the functioning of policies before making them operational. The sign-in logs provide details on which policies were evaluated during the login process and what their impact was. The What If function, on the other hand, allows you to simulate access scenarios to predict how policies would react to specific conditions, allowing you to correct any errors before implementing them.
Yes, you can configure policies that require passwordless authentication methods, such as Windows Hello, FIDO2, and Microsoft Authenticator. This reduces the risk of attacks based on compromised credentials, increasing the level of security for access to corporate resources.
One of the most common mistakes is configuring policies that are too restrictive, which could prevent legitimate users from accessing it. It's critical to ensure that critical roles, such as administrators, are always protected by multi-factor authentication. Another mistake is not regularly monitoring access logs, because they could reveal suspicious login attempts or misconfigurations. It is also important to avoid duplicate or contradictory policies, which could cause problems enforcing access rules.
To create a new Conditional Access policy, you must log in to the Entra ID portal and navigate to the Security > Conditional Access > Create new policy section. After selecting the target users and resources, you must define the access conditions and security controls to apply, such as MFA or session restrictions. Before activating the policy, it is advisable to test it in Report-only mode to verify its operation without affecting user access.
The Infra & Security team focuses on the management and evolution of our customers' Microsoft Azure tenants. Besides configuring and managing these tenants, the team is responsible for creating application deployments through DevOps pipelines. It also monitors and manages all security aspects of the tenants and supports Security Operations Centers (SOC).
