AZ-104
Deep Dive
IF-THEN policies that evaluate context signals and apply access controls. The AZ-104 tests policy configuration, named locations, risk conditions, and session controls.
Contents
Conditional Access is the IF-THEN policy engine of Entra ID. It evaluates context signals (who they are, where they're coming from, which device, which app, what risk level) and decides whether to allow, block, or add additional controls (MFA, compliant device, etc.).
Requires Entra ID P1 at minimum. For risk signals (Identity Protection) it requires P2.
Policy examples — IF → THEN logic
Users / Groups
Who the policy applies to. Include: everyone, specific groups, directory roles. Exclude: break-glass accounts, service accounts.
Cloud apps / Actions
Which apps it applies to. All apps, a specific selection (e.g., Salesforce), or user actions (e.g., registering a device).
Locations
Based on IP. Named Locations (trusted IP ranges) or countries/regions. "Any location" vs "All trusted locations" vs specific locations.
Device platforms
Operating system: Windows, macOS, iOS, Android, Linux. Useful for treating mobile differently from desktop.
Client apps
Client type: Browser (modern), Mobile/Desktop apps, Exchange ActiveSync (legacy), Other clients (legacy). Useful for blocking legacy authentication.
Sign-in risk (P2)
Risk score computed by Identity Protection: Low, Medium, High. Based on ML: login from a new country, Tor, credential spray, etc.
User risk (P2)
Cumulative risk for the user: leaked credentials, historical anomalous behavior. Low/Medium/High.
Device compliance / Hybrid join
Device status in Intune (compliant) or whether it's joined to on-prem AD DS (Hybrid Azure AD join). Requires Intune or Entra Connect.
Grant controls
What to do if the condition is met. Can be combined with AND or OR.
Block access
Denies access completely. The user sees an access error.
Require MFA
The user must complete MFA to gain access.
Require compliant device
The device must be marked compliant in Intune.
Require Hybrid Azure AD join
The device must be joined to on-prem AD DS via Entra Connect.
Require approved client app
Only Intune-managed apps or specific Microsoft apps.
Require authentication strength
Specify a minimum level (e.g., passwordless, phishing-resistant).
Session controls
Control the behavior within the session (not the initial access).
Sign-in frequency
How often the user must re-authenticate. E.g., "1 hour" for sensitive apps. Replaces the fixed token lifetime.
Persistent browser session
"Never persistent" — the browser doesn't remember the session. Useful on shared devices.
App-enforced restrictions
Exchange Online and SharePoint only: controls within the app (no download, no copy, read-only).
Conditional Access App Control (MCAS)
Microsoft Defender for Cloud Apps proxy for real-time inspection of session content.
Disable resilience defaults
If Entra ID has an outage, don't allow access with cached tokens. Maximum security, lower resiliency.
Define trusted IP ranges (offices, corporate VPN) or geographic locations to use as conditions in CA policies.
IP ranges (IPv4 / IPv6)
Entra ID → Security → Named locations → New location → IP ranges.
Maximum of 2,000 Named Locations per tenant. Each with up to 2,000 IP ranges.
Countries location
Group countries for geographic policies. Useful for blocking logins from unexpected countries.
• Select one or more countries/regions
• Based on the GeoIP of the login's IP address
• Case: blocking employee access from countries where the company has no operations
• Limitation: VPN or proxy IPs can bypass geographic detection
Exam gotcha: "All trusted locations" in a CA policy only includes Named Locations marked as "Mark as trusted location" — not all Named Locations.
Microsoft analyzes billions of signals daily to detect suspicious logins. Requires Entra ID P2.
The probability that a specific login isn't legitimate. Calculated in real time.
The probability that the user's identity is compromised. Cumulative.
Conditional Access doesn't just apply to human users. It can also apply to Workload Identities (service principals and managed identities). Requires the Entra ID Workload Identities Premium license.
Conditions available for Workload Identities
Service principal risk
Entra ID Identity Protection computes a risk score for the SP based on anomalous behavior, use of compromised IPs, etc.
IP location (Named Locations)
Restrict the SP to calling Azure only from specific IP ranges. Useful for apps that should only run from corporate or Azure IPs.
Real case: You have a Service Principal used in your CI/CD pipeline that should only call Azure Resource Manager. If someone steals the Client Secret and uses it from an external IP, the CA policy blocks access because the IP isn't in the allowed Named Locations.
Configuring CA for a Service Principal
Authentication Context lets you apply additional CA controls to specific actions within an application, not just at initial login. It implements "step-up authentication."
Scenario: banking app
Initial login (normal CA policy)
The user signs in → requires standard MFA → accesses their balance and transactions.
Sensitive action: transferring money
The app flags this action with a "transfer-funds" Authentication Context. The CA policy for that context requires re-authentication with phishing-resistant MFA.
The user must re-authenticate with their FIDO2 key just for the transfer, even though they're already authenticated in the app.
Configuration
Note: The app must support Authentication Context — it needs to call Entra ID with the correct parameter. Requires implementation in the app's code.
You can control which users can register or join devices to Entra ID using CA policies or direct restrictions.
Registration restriction
Entra ID → Devices → Device settings
"Users may register their devices" → All / Selected / None. If Selected: only the configured group can register.
Preventing users from registering personal BYOD devices without prior authorization.
CA policy for User Actions
CA policy → Cloud apps or actions → User actions
"Register or join devices" as the trigger. Apply conditions: require MFA, require compliant device to be able to register a new one.
Requiring MFA when someone registers a new device to prevent unauthorized registration.
Intune enrollment restrictions
Intune → Devices → Enrollment → Enrollment restrictions
Limit which platforms (iOS, Android, Windows) can enroll in Intune. Limit the number of devices per user.
Granular control of MDM enrollment beyond Entra ID registration.
✓ Best practices
✗ Mistakes that cause lockouts
Did you get this topic?
Test what you just learned
Which Conditional Access condition lets you block sign-ins from countries where the company doesn't operate?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.