AZ-900 Microsoft Azure Fundamentals Exam

Describe Microsoft Entra Conditional Access

Overview of Microsoft Entra Conditional Access

Microsoft Entra Conditional Access is a security tool that helps protect Azure resources by checking who is trying to access them and the conditions around the sign-in. It works like a gatekeeper that evaluates signals such as user identity, device state, location, and application context before allowing access. These policies adapt in real time to strengthen security and ensure compliance with organizational requirements. Conditional Access adds a dynamic layer of protection on top of regular username and password checks.

Policies in Conditional Access combine two main parts: assignments and controls. Assignments define who the policy applies to and what resources they are trying to reach, while controls set requirements like requiring multi-factor authentication or a compliant device. By combining these elements, administrators enforce least privilege access, which means giving users only the minimum permissions they need to do their jobs. This approach reduces security risks by ensuring that only authorized users on trusted devices can reach sensitive data.

Administrators can choose which users and groups a policy affects, or they can exclude certain accounts. Policies can target guest or external users, directory roles like Global Administrators, or specific users and groups including nested and dynamic groups. To prevent locking themselves out, Conditional Access shows a warning when a policy applies to all users and all apps. Administrators should exclude emergency access accounts from policies so they can always get in to fix problems. Microsoft recommends keeping two cloud-only break-glass accounts with the Global Administrator role for true emergencies.

Components of Conditional Access Policies

Conditional Access works as a policy engine that uses signals to make access decisions. Each policy has two key components: Assignments and Access controls. Policies only apply when they are enabled, and they can run in report-only mode to test settings before turning them on for real.

Assignments define who and what the policy applies to. Administrators configure which users or workload identities are included or excluded, such as groups, guests, emergency access accounts, or service principals. They also select which cloud apps or actions are targeted, like Microsoft Admin Portals or custom applications. Conditions specify things like location, device state, or risk signals such as user risk or insider risk. A policy only triggers when all assignment criteria are met.

Access controls specify what happens when assignments and conditions match. There are two main types: grant controls and session controls. Grant controls can block access entirely or grant access while requiring multi-factor authentication, a compliant device, password change, or acceptance of terms of use. Session controls enforce limits such as sign-in frequency or application-enforced restrictions. These controls help organizations enforce least privilege and reduce risk by granting only the necessary level of access.

To avoid accidental lockout, administrators should exclude break-glass and service accounts from policies. Using Conditional Access templates or testing in report-only mode helps validate settings before enforcement. After testing, administrators set Enable policy to On to enforce the rules.

Conditions and Signals in Conditional Access

Conditional Access is Microsoft Entra's Zero Trust policy engine that uses identity-driven signals to make access decisions. It works like an if-then statement: if a user tries to access a resource, then a policy is applied. These policies are enforced after first-factor authentication and use signals to allow, block, or require additional actions. This approach extends security beyond the network perimeter to focus on user and device identity.

Conditional Access gathers various signals to evaluate each sign-in request. These signals include user or group membership, IP location information using trusted IP ranges or blocking by country, and device state checking platform, compliance, or hybrid Azure AD join status. Signals also include the application being accessed so different rules can apply to different cloud apps like Microsoft 365. Real-time and calculated risk signals integrate with Microsoft Entra ID Protection risk levels, and Microsoft Defender for Cloud Apps can monitor and control user sessions in real time. Administrators can combine multiple signals to create fine-grained policies that match an organization's security requirements.

Based on the evaluated signals, administrators set conditions that trigger specific controls. Policies can block access entirely for untrusted sign-ins, grant access but require multi-factor authentication or a compliant device, or require users to accept terms of use or change their password before proceeding. This flexible approach supports both strict and relaxed access requirements based on context, allowing organizations to apply the right level of security without hindering productivity.

Implementing Conditional Access Policies

Conditional Access is a policy-based approach that enforces multifactor authentication and access controls based on a combination of signals. It helps protect resources by evaluating who the user is and the context of their sign-in, such as device state or network location. Organizations can adapt access based on risk and compliance requirements by applying granular conditions. Conditional Access works alongside existing identity and role-based controls to enhance overall security.

After disabling security defaults, administrators should enable Conditional Access policies in the Azure portal. Organizations with Microsoft Entra ID P2 licenses can also configure risk-based policies that respond to user or sign-in risk levels. Administrators can start with secure foundations templates to cover basic scenarios like requiring MFA or blocking legacy authentication, then expand with advanced controls for specific apps, actions, and contexts.

When configuring a policy, administrators define who is in scope by selecting users or groups, directory roles, or external user types. They use exclusions to protect break-glass accounts and critical service principals. Policies can target guest or external users such as B2B collaboration accounts, directory roles for high-privilege users, and workload identities for service principals registered in the tenant.

To prevent administrator lockout, policies should apply to a small pilot group first with at least one emergency access account excluded. Microsoft recommends maintaining two cloud-only break-glass accounts with the Global Administrator role that are used only for emergency scenarios. Always review warnings in the portal before enabling policies that apply to All Users or All Apps.

After deployment, administrators monitor and test policy impact by reviewing sign-in logs and Global Secure Access logs in the Azure portal. They use Microsoft Secure Score and identity score features to measure security posture and track improvements. Policies should be adjusted based on feedback and usage patterns to balance security and user experience.

Troubleshooting and Monitoring Conditional Access

Conditional Access policies help secure Azure resources by enforcing access controls based on user, device, and sign-in conditions. Troubleshooting and monitoring these policies ensures users can access resources when they should and are blocked when they should not. Regular reviews help administrators spot misconfigurations or unexpected behavior before they cause major issues. This process relies on built-in tools in the Entra ID portal and reporting features.

Troubleshooting often starts with the What If tool and policy inspection. Administrators can use the What If simulation to test how a policy applies to a specific user or sign-in. They can temporarily disable a policy to confirm if it is causing sign-in blocks. Inspecting assignments and conditions within each policy ensures they match the intended scope.

Monitoring Conditional Access uses Azure AD sign-in logs and the Conditional Access insights workbook. Sign-in logs show which policies were applied, which controls were granted or denied, and the user's device and location. The Conditional Access insights workbook in Azure Monitor provides visual reports on policy usage and trends. Alerts based on sign-in failures or risky sign-in events help quickly identify potential security issues.

Using report-only mode and impact reports helps evaluate policy changes safely. In report-only mode, policies do not enforce controls but still generate logs showing what would have happened. Administrators can analyze policy impact reports to fine-tune settings before turning policies fully on, reducing the risk of accidental lockouts.

Best practices for effective monitoring and troubleshooting include using consistent naming conventions for policies to make them easy to identify, excluding emergency access or break-glass accounts to prevent total lockout, and scheduling regular reviews of logs and insights to keep policies aligned with changing business needs.