L17. Terms of Use and Conditional Access Integration

What Are Terms of Use?

Terms of use (ToU) policies present legal or compliance documents that users must accept before accessing resources. They are typically used for acceptable use policies, privacy statements, NDAs, and regulatory compliance acknowledgments. Licensing: Entra ID P1 is required for terms of use policies.

Creating Terms of Use

Key configuration options when creating a ToU:

Exam tip: The "Require users to expand the terms of use" setting forces users to open and view the full document before the Accept button becomes active. This is important for demonstrating that users actually read the terms, not just clicked through.

Integrating with Conditional Access

Terms of use are enforced through Conditional Access policies. Without a CA policy referencing the ToU, users will never be prompted to accept. Configuration steps:

1. Create the terms of use document
2. Create a Conditional Access policy
3. Under Grant controls, select "Require terms of use" and choose the specific ToU
4. Assign the policy to the appropriate users, apps, and conditions

Exam tip: Terms of use appear as a grant control in Conditional Access, alongside MFA and device compliance. You can combine ToU acceptance with other grant controls using "Require all" or "Require one of."

Multi-Language Support

A single ToU policy can contain multiple language versions of the document. Each language version is a separate PDF uploaded to the policy. Entra ID detects the user's browser language preference and displays the appropriate version. If no matching language is found, the default language version is shown.

Tracking Acceptance

You can monitor ToU acceptance through several methods:

• Audit logs: Entra ID logs all accept/decline events
• ToU report: Shows acceptance status per user
• Microsoft Graph API: Programmatic access to agreement acceptance data

Navigate to: Entra admin center > Identity governance > Terms of use > [Select ToU] > View report

Re-Acceptance and Expiration

Two mechanisms force users to re-accept terms:

1. Expire consents on a specific date: All existing acceptances become invalid on a set date. Every user must re-accept.
2. Consent duration (recurring): Each user's acceptance expires after a set number of days from their acceptance date. They must re-accept when their individual consent expires.

Exam tip: Use "Expire consents" for policy updates that require everyone to re-accept simultaneously. Use "Consent duration" for ongoing periodic re-acceptance regardless of when the terms were last updated.

Per-Device Consent

When per-device consent is enabled, users must accept the terms on each device they use to access resources. This is useful for organizations that need to track compliance acknowledgment per device, such as BYOD scenarios where personal devices access corporate data.

Decline Behavior

If a user declines the terms of use, they are blocked from accessing the resource controlled by the Conditional Access policy. The decline is logged. Users can re-attempt access and choose to accept at any time.