How Conditional Access works
Three-step view of how it operates in practice.
- Collect signals. When a user tries to sign in, the system captures signals: user, device posture, location, IP reputation, application sensitivity.
- Evaluate policy. Signals are compared against policies you define, for example, block sign-ins from countries you don’t operate in, or require MFA on personal devices.
- Grant, challenge, or block. Based on the evaluation, the request gets through, gets a step-up challenge (MFA or device compliance), or is blocked outright.
Why Conditional Access matters
For a smaller organization, conditional access is the difference between a stolen password being a catastrophe and being a non-event: the credential alone no longer opens the door if the location, device, or behavior is wrong. It is built into licensing many businesses already pay for, and insurers and auditors increasingly expect these policies to be in place and documented.
The four main policy types
- Location-based policies. Block or challenge sign-ins from countries or networks where your organization has no business being. A login attempt from overseas at 3 a.m. simply never gets a chance to use a stolen password.
- Device-based policies. Require the device itself to be known and healthy — enrolled in management, encrypted, up to date, before it can touch company data. A stolen password on an unknown laptop gets nowhere.
- Application-based policies. Apply tighter rules to sensitive systems — finance, HR, admin portals, than to low-risk ones. Not every application deserves the same gate.
- Risk-based policies. The identity platform scores each sign-in using signals like impossible travel, leaked credentials, and unfamiliar behavior, then challenges or blocks the risky ones automatically.
Common Conditional Access mistakes
- No break-glass account. A misconfigured policy can lock every administrator out of the tenant, including the people who would fix it. Keep one heavily monitored emergency account excluded from policies, with credentials stored offline.
- Enforcing without report-only first. Turning a new policy straight on is how a whole office gets locked out on a Monday morning. Run policies in report-only mode for a week or two, review who would have been blocked, then enforce.
- Leaving legacy protocols as a side door. Older sign-in methods used by ancient mail clients and scanners can bypass policy evaluation entirely. Block legacy authentication, or scope it to the one device that truly needs it.