MSDEVBUILD / azure

Conditional Access

👤Who📍Where💻Device🧩App⚠️Risk🚦Conditional Access✅Allow📱Require MFA⛔BlockIf these signals… then this decision.
Conditional Access reads the signals, then decides: allow, ask for MFA, or block.

😟 THE PROBLEM

Every sign-in is treated the same, from the office desk or an unknown country at 3 a.m.

😊 THE SOLUTION

Use Conditional Access policies based on signals.

  • Sign-ins from risky places✓ Require MFA or block
  • Unmanaged devices reach sensitive apps✓ Require a compliant device
  • Admins with weak sign-in✓ MFA for all admins
🛠️ Solved with: Microsoft Entra Conditional Access
Module 2: Architecture & Services ⏱ 6 min read Updated 11 Nov 2026

Quick answer

Microsoft Entra Conditional Access is a tool that uses signals, such as who the user is, their location, device, the app they want and sign-in risk, to make an access decision: allow access, require MFA or another control, or block access. It works like an "if this, then that" policy for sign-ins.

Exam objective: 2.4.4 Describe Microsoft Entra Conditional Access. (Skills measured as of July 20, 2026)

Start with a question

Should signing in from your office desk be treated the same as signing in from an unknown country at 3 a.m.?

Of course not. Conditional Access looks at the situation and decides what to ask for.

Explain it like I’m 10

The technical explanation

  1. 1 Signals

    User or group, location (IP), device state, application, sign-in risk.

  2. 2 Policy

    If the user is an admin and outside the trusted network…

  3. 3 Decision

    …require MFA. Other options are allow, require a compliant device, or block.

  4. 4 Enforcement

    Applied at sign-in, for every app connected to Entra ID.

How Conditional Access works

Real-world business scenario

Banking

A financial advisory firm

The problem
Advisers needed to work from anywhere, but compliance required strong controls on client data.
What they used
Conditional Access: MFA outside the office, compliant devices for the client app, and blocks on high-risk sign-ins.
Why that choice
Security adapts to the situation instead of blocking or allowing everyone equally.
The result
Flexible working with stronger security and a smooth experience in the office.

When to use it and when not to

✓ Use it when…

  • Require MFA based on risk or location.
  • Protect sensitive apps with device requirements.

✕ Think twice when…

  • Turning on broad block policies without report-only testing.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is Conditional Access?

Model answer

A set of rules in Microsoft Entra ID that decides how someone can sign in based on conditions. For example, if they sign in from outside the office, they must use MFA.

Intermediate Give three example Conditional Access policies.

Model answer

Require MFA for all administrators. Block sign-ins from countries where the company does not operate. Require a compliant or company-managed device to access sensitive apps.

Experienced developer How do you roll out Conditional Access safely?

Model answer

Start in report-only mode to see the impact, exclude emergency break-glass accounts, target pilot groups first, use the What If tool, and monitor sign-in logs before switching policies on for everyone.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

You want to require MFA only when users sign in from outside the corporate network. What should you use?

Question 2

Question 2 of 3 · Select 2

Which TWO are signals Conditional Access can use?

Question 3

Question 3 of 3

Which is NOT a typical Conditional Access decision?

Quick revision

Key points

  • Conditional Access = if signals, then decision.
  • Signals are user/group, location, device, app and risk.
  • Decisions are allow, require MFA or another control, or block.
  • Part of Microsoft Entra ID.

Important terminology

Conditional Access policy
An if-then rule combining signals and an access decision.
Signal
Information used in the decision, such as user, location, device, app or risk.
Grant control
The requirement or decision, such as require MFA, require a compliant device, or block.

Common mistakes

  • Confusing Conditional Access (sign-in decisions) with Azure RBAC (permissions on resources).

Exam tips

  • "Require MFA only when users sign in from outside the office" = Conditional Access.

Five quick revision questions

  1. 1.What does Conditional Access use to decide?Show

    Signals such as user, location, device, app and risk.

  2. 2.Name three possible decisions.Show

    Allow, require MFA (or another control), block.

  3. 3.Which service provides Conditional Access?Show

    Microsoft Entra ID.

  4. 4.What mode lets you test a policy without enforcing it?Show

    Report-only mode.

  5. 5.Give an example policy.Show

    Require MFA for all administrators.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Azure Role-Based Access Control (RBAC)