What is Conditional Access?
Short answer
Conditional Access is a Microsoft Entra ID feature that decides whether a sign-in is allowed based on who is signing in, from what device, and from where. It lets you require multi-factor authentication, block risky locations, or allow access only from managed computers. It requires Entra ID P1, which is included in Business Premium, E3, and E5.
Draft · pending expert review
A password alone decides only one thing: whether someone knows it. Conditional Access asks better questions before letting anyone in.
Common policies
- Require multi-factor authentication for everyone
- Block sign-ins from countries where you don't do business
- Allow access to company data only from managed, up-to-date devices
- Require stronger verification for administrators
Licensing
Conditional Access needs Entra ID P1, included in Microsoft 365 Business Premium, E3, and E5. Without it, Microsoft's free "security defaults" provide a basic baseline.
A word of caution
A misconfigured policy can lock everyone out, including you. Test policies in report-only mode first, and always keep a break-glass admin account.