How to Configure Conditional Access Policies in Azure Active Directory (Entra ID)

Introduction

As organizations migrate away from traditional corporate networks, the perimeter is no longer a physical firewall—it is the user’s identity. Microsoft Entra ID (formerly Azure Active Directory) Conditional Access is the engine that drives Zero Trust security. Conditional Access policies act as intelligent if/then statements: If a user attempts to access an application, Then evaluate their risk profile and decide whether to allow access, require Multi-Factor Authentication (MFA), or block them entirely. This guide walks you through configuring a robust Conditional Access policy.

Prerequisites

To create Conditional Access policies, you must have an Azure AD Premium P1 or P2 license (included in Microsoft 365 Business Premium and E3/E5). You also need the Global Administrator, Conditional Access Administrator, or Security Administrator role.

Step 1: Define the Policy Scope (Users and Apps)

First, determine who the policy applies to and what they are trying to access.

1. Log in to the Microsoft Entra admin center (entra.microsoft.com).
2. Navigate to Protection > Conditional Access > Policies.
3. Click New policy and give it a descriptive name, such as “Require MFA for Remote Admins”.
4. Under Assignments, click Users. Select the specific users or groups to include. It is best practice to target a pilot group first and always exclude a dedicated “Break Glass” emergency administrator account to prevent accidental tenant lockouts.
5. Click Target resources. You can choose “All cloud apps” for blanket protection or select specific applications like Office 365 or Azure Management.

Step 2: Configure Conditions

Conditions define the circumstances under which the policy triggers.

• User Risk & Sign-in Risk: (Requires P2 license) Trigger the policy if Microsoft’s AI detects anomalous behavior, like leaked credentials or unfamiliar travel.
• Device Platforms: Apply the policy only to Windows, macOS, iOS, or Android devices.
• Locations: This is highly useful. You can configure “Trusted IPs” (like your corporate office network). You can then set a condition that triggers the policy only when users are connecting from any location except your Trusted IPs.
• Client Apps: Filter whether the user is connecting via a modern browser, a mobile app, or legacy authentication protocols (which should generally be blocked).

Step 3: Define Access Controls

Once the conditions are met, the Access Controls dictate what happens next.

1. Under Access controls, click Grant.
2. Select Grant access to allow the login, but check the box for Require multifactor authentication.
3. Optionally, you can require that the device be marked as compliant by Microsoft Intune (MDM) or be Hybrid Azure AD joined.
4. If you select multiple controls, choose whether you require all the selected controls or just one of them.
5. Alternatively, you can select Block access to outright deny the connection (useful for blocking logins from high-risk countries).

Step 4: Enable Report-Only Mode

One of the most dangerous things an administrator can do is enforce a Conditional Access policy blindly. A misconfigured policy can block the entire company from logging in.

At the bottom of the policy configuration screen, look for the Enable policy toggle. Set it to Report-only. In this mode, the policy is evaluated during sign-ins, and the results are logged in Azure AD Sign-in logs, but users are not actually prompted for MFA or blocked. Let the policy run in Report-only mode for a few days to analyze its impact.

Once you confirm the policy is behaving as expected, change the toggle to On and click Save.