Microsoft Entra Conditional Access

Azure identity, access, and security

📘Microsoft Certified: Azure Fundamentals (AZ-900)

---

Absolutely! Let’s break down Microsoft Entra Conditional Access for the AZ-900 exam in simple, clear, exam-focused language. I’ll cover everything you need to know so your students can understand it, even if they aren’t IT experts.

---

Microsoft Entra Conditional Access – Explained

What is Microsoft Entra Conditional Access?

Microsoft Entra Conditional Access (CA) is a security tool in Azure that controls who can access resources, under what conditions, and how.

Think of it as rules that decide if a user is allowed in, needs extra verification, or gets blocked. It’s part of Azure Active Directory (Azure AD), which manages identities and access.

It’s important for the AZ-900 exam because it helps organizations protect their data and secure applications while keeping access flexible for users.

---

Key Concepts

1. Users and Groups
   • Conditional Access rules target specific users or groups.
   • Example: Apply stricter rules for admins than for regular users.
2. Cloud Apps
   • Rules can apply to specific cloud apps like Microsoft 365 apps (Teams, SharePoint) or custom enterprise apps.
3. Conditions
   Conditional Access rules can consider multiple conditions before granting access:
   • Location: Allow access only from trusted networks or countries.
   • Device state: Access only from devices that are compliant (managed and secure).
   • Application: Some apps may require stronger verification.
   • Sign-in risk: Azure AD can detect suspicious login attempts (e.g., login from unusual location).
4. Access Controls
   After evaluating conditions, Conditional Access decides what controls to enforce:
   • Require multi-factor authentication (MFA): Ask for additional verification, like a text code or app approval.
   • Require device compliance: Only allow access from devices that meet security policies.
   • Require app protection policies: Ensure apps meet security standards.
   • Block access: Deny access entirely if conditions aren’t met.
5. Policies
   • A Conditional Access policy is a set of rules combining who, what, and how.
   • Policies can be enabled or disabled, allowing IT admins to test them safely.
   • Policies are evaluated at each sign-in, making real-time decisions.

---

How Conditional Access Works (Step-by-Step)

1. User tries to sign in
   • Example: Alice logs into Microsoft Teams.
2. Azure AD evaluates policies
   • Checks the user, group, location, device, app, and risk level.
3. Decision made
   • Based on the conditions, Azure AD applies the access control:
     • Allow access
     • Require MFA
     • Block access
     • Require compliant device
4. Access granted or blocked
   • Access is enforced immediately based on the policy.

---

Important Exam Points

For AZ-900, focus on understanding the purpose and functionality rather than deep technical setup:

1. Purpose of Conditional Access
   • Protects organizational data.
   • Ensures secure access for users, even from outside networks.
   • Enforces policies based on risk and compliance.
2. How Policies Work
   • Combines conditions (who, where, device, app) + controls (MFA, compliant devices, block access).
   • Applied at sign-in or session start.
3. Conditional Access vs. MFA
   • Conditional Access can require MFA, but it’s more flexible.
   • MFA is just one control; Conditional Access can combine multiple conditions.
4. Integration
   • Works with Microsoft Entra ID (Azure AD).
   • Can protect Microsoft 365 apps, Azure resources, and third-party apps.
5. Security Benefits
   • Reduces risk of unauthorized access.
   • Protects sensitive apps and data.
   • Supports zero trust security by validating who and what before granting access.

---

Simple Table to Remember

Feature	Explanation
Who	Users or groups targeted by the policy
What	Cloud apps or resources the policy applies to
Conditions	Location, device state, sign-in risk, app, client type
Controls	MFA, device compliance, block access, app protection
Evaluation	Real-time, at each sign-in
Purpose	Secure access, reduce risk, enforce zero trust

---

✅ Summary for Exam:

• Conditional Access is a security layer in Azure AD.
• Policies evaluate users, apps, devices, locations, and risk.
• Policies enforce controls like MFA, device compliance, or block access.
• Helps organizations secure apps and data while enabling flexible access.