Definition
Conditional access
In one sentence
Conditional access is an identity security feature, notably in Microsoft Entra ID, that grants, blocks or adds requirements to sign-ins based on conditions such as user, device health, location, application and risk level.
Multi-factor authenticationZero trustPhishing-resistant MFAMicrosoft Secure Score
Conditional Access Explained
Conditional access works as a set of if-then policies. If a user signs in to Microsoft 365 from an unmanaged device, require MFA and block downloads. If the sign-in comes from a country where you have no staff, block it. If the user is a global administrator, require phishing-resistant MFA. If Microsoft's risk engine flags the sign-in as risky, force a password change.
It is one of the most effective controls available to Microsoft 365 customers, because it limits where and how stolen credentials can be used. Requiring a compliant, company-managed device, for example, stops an attacker who has a stolen session cookie on their own machine.
Conditional access requires Microsoft Entra ID P1 licensing, which is included in Microsoft 365 Business Premium. Tenants without it rely on Security Defaults, which enforce basic MFA but offer little flexibility. Test policies in report-only mode first, exclude a monitored emergency access account, and review policies whenever staff, devices or applications change.
General information for Canadian organizations, not legal advice.