Conditional Access
Policy-driven access decisions evaluated at sign-in time. Inputs include identity, device, location, risk signals, and application sensitivity. Microsoft Entra Conditional Access popularized the term; equivalent capability exists across IAM platforms.
Conditional access is where most organizations actually implement zero trust, because it is the one place policy can consider identity, device, location, and risk together at the moment of access. Two failure modes recur: exclusions that were added for a migration and never removed, and policies that require "MFA" generically rather than a phishing-resistant method, which relay kits satisfy. Audit the exclusion list more often than the policy list.
See also: what is zero trust, adaptive auth, device posture, phishing-resistant MFA
Related on Start with Identity
- GlossaryMicrosegmentation
Microsegmentation is a network control that divides an environment into small zones and allows only the connections policy explicitly permits between them, so a
- GlossaryStep-up Authentication
Requiring additional authentication when a user attempts a higher-risk action, such as changing email or initiating a large payment. Implemented via OIDC `acr_v
- GlossaryZTNA
Zero Trust Network Access. The product category that replaces VPNs with identity-aware proxies. ZTNA grants access to specific applications based on identity an
- PodcastKuppingerCole Analyst Chat
Weekly conversations between KuppingerCole analysts on identity architecture, governance, AI agents, and the market. Over 300 episodes since 2020.
- GuideConditional Access Policies: A Complete Implementation Guide for Microsoft Entra
Master Microsoft Entra conditional access with risk-based policies, device compliance rules, location-based restrictions, and real-world deployment patterns.
- TemplateConditional Access Policy Plan Worksheet
A planning worksheet for conditional access policies: a naming standard, a policy inventory table (users, apps, conditions, grant, session, exclusions, report-o