Conditional Access
Microsoft Entra's policy engine for controlling access based on signals like user, device, location and risk — not just a password check.
Conditional Access evaluates real-time signals — who’s signing in, what device they’re on, where they’re connecting from, how risky the session looks — and makes an access decision based on policies you define: allow, block, or require extra verification.
It’s the mechanism that turns other identity controls (MFA, device compliance) from settings into actual enforcement. A policy might require MFA only when a sign-in looks risky, or block access entirely from countries your organisation has no legitimate presence in.
Conditional Access is a core part of implementing Zero Trust — “never trust, always verify” only works if something is actually verifying every request.