Skip to main content

060: Conditional Access policy

Implementation Effort: High

User Impact: High

Overview​

Conditional Access is the enforcement layer that turns identity and device signals into real access decisions. In device-focused Zero Trust guidance, the most common pattern is to require a compliant device for access to sensitive resources. For BYOD or app-only scenarios, some organizations instead require an approved client app or app protection policy path, depending on the application and licensing model.

Conditional Access should be deliberate, phased, and tested; it is not just a checkbox attached to device compliance.

Implementation Guidance​

  1. Identify the apps and data you want to protect first, such as Exchange Online, SharePoint Online, Teams, or admin portals.
  2. Decide which mobile access pattern applies to each resource: require compliant device, require app protection policy, or another supported control. Do not assume one policy fits every scenario.
  3. Create policies in Microsoft Entra ID and use report-only mode where possible before enforcement. Include break-glass or emergency accounts in planned exclusions.
  4. If using the compliant-device model, ensure the target users and devices already have working Intune enrollment, compliance policies, and remediation communications.
  5. Keep user targeting and resource targeting simple at first. Complex overlapping policies are harder to support and harder to explain during incidents.
  6. Validate the end-user sign-in flow across iOS/iPadOS, Android, browsers, and rich clients. Confirm what happens when a device falls out of compliance or is retired.
  7. Document the intended exceptions for contractors, shared devices, kiosks, or MAM-only mobile access so administrators do not invent ad hoc workarounds later.

Reference​