Conditional access is a policy engine in Microsoft Entra ID that decides whether to allow, block, or require more verification for a sign-in based on conditions such as user, device, location, and risk.
Key takeaways
What to know before you act
- Conditional access evaluates signals—user, device, location, application, and risk—before allowing a sign-in.
- It is the policy engine behind zero trust in Microsoft 365 and requires Entra ID P1 or higher.
- Test in report-only mode and always keep an excluded emergency access account.
Why it matters
What business leaders should understand
Passwords and basic MFA treat every sign-in the same. Conditional access lets a business require stronger protection where risk is higher and block access from untrusted devices or locations.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with microsoft 365 services, cloud services, and managed email security.
Related reading: What is Microsoft Intune? and Microsoft 365 security checklist.
How conditional access works
Microsoft describes conditional access as if-then statements: if a user wants to access a resource, then they must complete an action. Policies combine assignments (who and what) with conditions (where, which device, what risk) and controls (block, require MFA, require a compliant device).
- Require MFA for all users, and phishing-resistant MFA for administrators.
- Block legacy authentication protocols.
- Require compliant or hybrid-joined devices for sensitive applications.
- Block sign-ins from countries where you do not operate.
- Require MFA or block access when sign-in risk is high.
Deploying policies safely
A misconfigured policy can lock everyone out, including administrators. Use report-only mode to see what a policy would do before enforcing it, exclude at least one monitored emergency access account, and roll out to pilot groups first.
If your plan does not include conditional access, Microsoft's security defaults provide a simpler baseline of MFA and legacy authentication blocking.
Practical action plan
Steps your business can take
Confirm your licensing includes Entra ID P1 or higher.
Start with policies requiring MFA and blocking legacy authentication.
Require compliant or managed devices for sensitive apps.
Test policies in report-only mode and keep an emergency access account.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
What is Microsoft Intune?
Make device compliance part of access decisions.
Explore nextRelated guide
Microsoft 365 security checklist
See where conditional access fits among other settings.
Explore nextRelated guide
What is zero trust security?
Understand the strategy conditional access supports.
Explore nextService
Cybersecurity services
Design and monitor identity protections.
Explore nextWarning signs
Do not ignore these indicators
- Everyone can sign in from any device with the same requirements
- Legacy authentication is still allowed
- Policies were created without testing or documentation
Frequently asked questions
Common questions, answered.
What is conditional access?
A Microsoft Entra ID policy engine that allows, blocks, or adds requirements to sign-ins based on user, device, location, and risk.
What license is required for conditional access?
Microsoft Entra ID P1 or higher, included in some Microsoft 365 plans.
How do we avoid locking everyone out?
Test policies in report-only mode, pilot with small groups, and keep an excluded emergency access account.
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
Microsoft Learn
What is Conditional Access?
Microsoft's explanation of Conditional Access signals, decisions, and common policies.
Microsoft Learn
Security defaults in Microsoft Entra ID
Microsoft's baseline identity protections, including MFA registration and blocking legacy authentication.
National Institute of Standards and Technology
NIST SP 800-207: Zero Trust Architecture
Defines zero trust principles that shift protection from network location toward users, assets, and resources.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.