IT Glossary

Conditional Access

Conditional access is an if-then policy engine that decides at sign-in whether to allow, require MFA or block. How it works, licensing and where it stops.

November 2, 2026

What is conditional access?

Conditional access is an if-then policy engine that evaluates signals at each sign-in and decides what happens next. If the user, the application, the device, the location or the sign-in risk matches a condition, then the identity provider allows access, requires an extra control such as MFA or a compliant device, or blocks the attempt. Conditional Access is also the name of a Microsoft Entra ID feature.

Key takeaways

  • Conditional access evaluates signals such as user, application, device compliance, location and sign-in risk, then allows, challenges or blocks each sign-in.
  • Microsoft Entra Conditional Access requires Microsoft Entra ID P1 licenses, while risk-based conditional access policies require Microsoft Entra ID P2.
  • Conditional access only applies to applications that sign in through the identity provider, so SaaS tools with local passwords are never evaluated.
  • Conditional access applies rules that administrators write in advance, while adaptive authentication computes a risk score that a policy can use as one signal.

How conditional access works

  • Assignment: each policy targets users or groups and one or more applications, with exclusions such as emergency break-glass accounts.
  • Conditions: the policy reads signals such as device compliance, network location or country, client type and sign-in risk.
  • Decision: access is granted, granted only after a control (MFA, a compliant device, an approved app) or blocked.
  • Session controls: some policies also limit how long a session lasts or force a new sign-in after a set time.
  • Combination: every matching policy applies at once, and a block in any one of them wins over the grants.

Conditional access or adaptive authentication, and where does it stop?

  • Conditional access: deterministic rules written by administrators, for example "admins must use a compliant device". The same request always gets the same answer.
  • Adaptive authentication: a risk score computed for each attempt from behavior and context, which raises or lowers the challenge. In risk-based policies, that score becomes one condition among others.

Conditional access maps to the model described in NIST SP 800-207 (Zero Trust Architecture, August 2020): a policy decision point decides each access request and a policy enforcement point applies the result. The limit is coverage. The identity provider only decides for sign-ins it sees, so an application with its own login form never reaches the policy, however strict the policy is. Okta and Google Workspace offer equivalent engines under other names, with the same limit.

Examples and use cases

A 300-person logistics company licenses Microsoft Entra ID P1 and sets three conditional access policies: MFA for every user, a compliant device for finance and admin portals, and a block on sign-ins from countries where it has no staff. The security dashboard looks clean. A SaaS discovery exercise then finds 35 applications used with local passwords, including a freight pricing tool and a design suite, where none of those policies is ever evaluated.

Corma connects to Microsoft Entra ID, Okta, Google Workspace and JumpCloud and builds the inventory of SaaS applications in use, including shadow IT outside single sign-on. IT can move the critical tools behind the identity provider, and Corma automates provisioning and deprovisioning for the rest, including apps without SCIM.

Related concepts

FAQ

Is conditional access a Microsoft feature?

Yes, Conditional Access is the name of the Microsoft Entra ID feature, and it requires Microsoft Entra ID P1 licenses, with P2 for risk-based policies. The concept is broader: other identity providers offer the same if-then logic under other names.

What is the difference between conditional access and MFA?

MFA is a control; conditional access decides when to require it. A policy can demand MFA for every sign-in, only outside the office network, or only for admin roles.

Does conditional access protect apps that are not behind SSO?

No. Conditional access only evaluates sign-ins that go through the identity provider. Applications with their own usernames and passwords bypass every policy until they are federated.

What are common conditional access policies?

Require MFA for all users, block legacy authentication protocols, require a compliant device for admin portals and block sign-ins from countries where the company does not operate.

Request a demo