Identity resilience glossary
Microsoft Entra Conditional Access
Microsoft Entra Conditional Access evaluates identity and access signals against policies to determine whether access should be blocked or subject to requirements. Policies can consider the user, application, device, location, and risk signals, depending on configuration and licensing. They can require controls such as multifactor authentication or a compliant device before access is granted.
Why it matters
Conditional Access translates access requirements into rules that affect real sign-ins. A change to the targeted users or applications can broaden a policy's effect beyond its original purpose. For identity teams, the operational question is whether the policy applies to the intended people and resources while preserving the access they legitimately need.
Illustrative identity example
A team proposes a compliant-device requirement for an internal reporting application. Its review finds that the target group also contains contractors whose devices are not managed by the organization. Report-only evaluation can help reveal the potential effect before enforcement. The team reviews the access requirement and intended audience rather than assuming every failed evaluation is a configuration error.
Common misunderstanding
Report-only mode evaluates a policy without enforcing its access controls; it is not the same as turning protection on. It also has documented limitations, including possible device-certificate prompts in some scenarios. A successful result for one policy does not prove that sign-in will succeed, because another applicable policy may still block access.
Recovery considerations
Recovering a policy requires checking its references as well as its settings. Targeted groups, users, and applications may have changed or been recreated with different identifiers. Compare the intended configuration and validate the resulting sign-in behavior. A saved policy definition does not establish that every dependency or property is supported by a particular restore tool; confirm that scope separately.