A Microsoft Entra ID policy engine that evaluates signals (location, device, session risk, application) to decide whether to allow, block, or require additional controls (MFA) when accessing a resource.
On AZ-305 this is designed as a Zero Trust security layer. Typical question: require MFA only when the user connects from outside the corporate network → a location-based Conditional Access policy. Requires an Entra ID P1/P2 license.
Conditional Access is a concept that can show up on the exam. Check the full guide to see it in context.