L6. Conditional Access: Policies, Named Locations and Risk

Conditional Access Architecture

Conditional Access (CA) is the policy engine at the heart of Entra ID zero trust. Every sign-in is evaluated against your policies, and access is granted, denied, or requires additional verification based on the conditions you define.

A CA policy has two main components:

• Assignments: WHO is signing in, to WHAT application, under WHICH conditions
• Access controls: WHAT must happen (grant controls) and HOW the session behaves (session controls)

Assignments

Users and Groups

You can include or exclude specific users, groups, directory roles, or guest/external users. Common patterns:

• Include: All users. Exclude: emergency access (break-glass) accounts
• Include: A specific group. Exclude: none

Cloud Apps or Actions

Target specific applications, all cloud apps, or user actions (like registering security info or registering/joining devices).

Conditions

• Sign-in risk: Requires Entra ID Protection (P2). Levels: None, Low, Medium, High
• User risk: Requires Entra ID Protection (P2). Levels: None, Low, Medium, High
• Device platforms: iOS, Android, Windows, macOS, Linux
• Locations: Named locations (IP ranges, countries)
• Client apps: Browser, mobile apps, desktop clients, legacy auth clients
• Device state/filter: Target managed or compliant devices

Access Controls

Grant Controls

• Block access: Deny sign-in entirely
• Grant access with requirements: MFA, compliant device, hybrid-joined device, approved app, app protection policy, password change, custom authentication strength

Session Controls

• Sign-in frequency (how often to re-authenticate)
• Persistent browser session
• Conditional Access App Control (proxy through Defender for Cloud Apps)
• Customize token lifetime (continuous access evaluation)

Exam tip: When multiple grant controls are selected, you choose "Require all" or "Require one of." For maximum security, use "Require all." Most exam scenarios test the "Require all" pattern with MFA + compliant device.

Named Locations

Named locations define trusted or known IP ranges and countries:

• IP ranges: Define corporate network CIDR ranges and mark them as trusted
• Countries: Select countries based on IP geolocation

Named locations are referenced in CA policy conditions to differentiate corporate network sign-ins from external sign-ins. Exam tip: Marking a location as "trusted" does not automatically grant access. It allows you to create policies that behave differently for trusted vs. untrusted locations (e.g., skip MFA on the corporate network).

What If Tool

The What If tool simulates CA policy evaluation for a specific user and scenario. It shows which policies would apply and which would not, along with the reasons. This is the primary troubleshooting tool for CA issues.

Navigate to: Entra admin center > Protection > Conditional Access > What If

Policy Evaluation Order

All CA policies are evaluated simultaneously (not sequentially). If any applicable policy blocks access, access is blocked regardless of other policies. Grant controls from all applicable policies are combined. Exam tip: Block always wins. If one policy grants access with MFA and another blocks access for the same scenario, access is blocked.

Global Secure Access (October 28, 2026 outline)

Global Secure Access is Microsoft's Security Service Edge (SSE) solution in Microsoft Entra. It includes Microsoft Entra Private Access and Microsoft Entra Internet Access, and devices reach it through the Global Secure Access client (or through configured remote networks).

Deploy Global Secure Access clients

The Global Secure Access client acquires traffic on the device based on the traffic forwarding profiles you enable (Microsoft traffic, Private Access and Internet Access) and sends it to the service, where identity-aware controls such as Conditional Access apply. Clients are available for Windows, macOS, Android and iOS. The client uses a lightweight filter driver instead of a VPN connection, so it can coexist with other VPN or SSE products. Exam tip: If a device has no client (and isn't behind a configured remote network), or the matching traffic forwarding profile isn't enabled, its traffic never reaches Global Secure Access, and Private Access or Internet Access controls don't apply to it.

Deploy and manage Microsoft Entra Private Access

Private Access replaces a traditional VPN for private and on-premises resources. You define the FQDNs, IP addresses and IP ranges you consider private, and a Microsoft Entra private network connector installed on your network brokers the connection. There are two ways to publish resources: Both create an enterprise application, so you assign users and groups to it and target it with Conditional Access like any other app.

Deploy and manage Microsoft Entra Internet Access

Internet Access secures traffic to the public internet and SaaS apps. You build web content filtering policies that allow or block web categories or specific FQDNs, group them into security profiles, and can link a security profile to a Conditional Access policy so different users get different filtering.

Deploy and manage the Microsoft traffic profile for Microsoft 365

The Microsoft traffic profile comes with preconfigured FQDNs and IP ranges derived from the Microsoft 365 endpoint list, grouped by application type. Each rule has an action of Forward (the client or remote network acquires the traffic) or Bypass (traffic goes out directly). Traffic covered by the Microsoft traffic profile can only be acquired by that profile, so bypassing a rule there doesn't send it through the Internet Access profile instead.

Tying Global Secure Access into Conditional Access

After you enable Conditional Access signaling in Global Secure Access settings, Conditional Access gets a named location called All Compliant Network locations. A typical policy blocks all locations except compliant networks, so sign-ins (and token replay attempts) that don't come through your tenant's Global Secure Access are denied. Unlike IP-based named locations, there are no egress IP ranges to maintain, and the check is tenant-specific. Exam tip: Know the split. Private Access covers your private apps, Internet Access covers the open internet and SaaS, and the Microsoft traffic profile covers Microsoft 365 traffic. The compliant network check is a Conditional Access location condition, not a device compliance control.