Conditional Access is the heart of Zero Trust access control in Microsoft Entra ID. Instead of blanket rules, context-based policies decide on every access attempt.
What is Conditional Access?
Conditional Access evaluates on every sign-in attempt:
- Who is trying to access (user, group)
- From where (location, network)
- With which device (compliance, platform)
- To which resource (app, data)
- Under what risk (sign-in/user risk)
Typical Policies for Swiss Companies
Basic Policies
- 1MFA for all users
- When accessing from outside the corporate network
- For all cloud applications
- Exceptions only with strong justification
- 1Device Compliance
- Only managed devices for sensitive data
- BYOD only for non-critical applications
- Automatic quarantine on compliance violations
- 1Location-based rules
- Known office locations as trusted
- VPN dial-in for remote access
- Blocking from high-risk countries
Advanced Policies
- 1Risk-based access
- Elevated risk → Additional verification
- High risk → Block access, reset password
- Integration with Microsoft Defender for Identity
- 1Session Controls
- Timeout for sensitive applications
- No persistence on foreign devices
- Restricted access (view-only) at risk
Implementation Best Practices
Gradual Introduction
- 1Report-Only mode – Test policies without impact
- 2Pilot groups – First IT, then extended groups
- 3Rollout – Gradually for all users
- 4Monitoring – Continuously monitor sign-in logs
Avoid Common Mistakes
- Not too many policies – Maintain clarity
- Exclude emergency accounts (break-glass)
- Regular policy reviews
- Keep documentation current
Monitoring and Reporting
Sign-in Logs
Every sign-in attempt is logged:
- Successful and failed sign-ins
- Which policies were applied
- Reason for blocking or granting
Workbooks and Dashboards
Visualize:
- Policy application frequency
- Blocked accesses by reason
- Trends over time
Conclusion
Conditional Access policies are essential for modern security. Properly configured, they offer maximum protection with minimal user restriction. CNEXT supports you in design and implementation.