Topic 4 of 5
Conditional Access, Global Secure Access, and roles
Access management in Entra rests on three pieces: Conditional Access decides whether someone gets in and under what conditions, Global Secure Access protects network traffic, and roles define what each administrator can do.
Contents
What is Conditional Access?
It's Microsoft's Zero Trust policy engine: it brings signals together, makes decisions, and enforces organizational policies. At its simplest, a policy is an if-then statement: if a user wants to access a resource, then they must complete an action. For example: if they want to access Microsoft 365, they must do MFA.
Admins pursue two goals at once: keeping users productive wherever and whenever, and protecting the organization's assets. Conditional Access applies the right control only when needed, without getting in the way the rest of the time.
When it applies
After first-factor authentication is completed. It isn't the frontline defense against denial-of-service (DoS) attacks, though it can use signals from those events.
How a policy is evaluated
The user completes the first factor
For example, the password.
Signals are collected
Who they are, from where, on which device, to which app, and with what risk.
They're compared with the assignments
If all are met (logical AND), the policy applies.
A decision is made
Block, grant outright, or grant while requiring controls (MFA, compliant device…).
The session is applied
If there are session controls, they limit what can be done inside the app.
Assignments (signals)
They define the who, what, where, and when. They're combined with a logical AND: if you configure several, all must be met for the policy to trigger.
Users
All users, specific users and groups, directory roles, external guests, workload identities, and agent identities, which extends Zero Trust to AI workloads.
Target resources
Cloud apps (including Microsoft 365 and Entra registered apps), on-premises apps, user actions (registering security info, registering or joining devices), Global Secure Access traffic profiles, or authentication context to protect specific data and actions.
Network
Trusted networks and IP ranges, named locations (entire countries can be blocked or allowed), and compliant networks.
Conditions
Sign-in and user risk (ID Protection), insider risk (Purview adaptive protection), device platform, client apps (browser, mobile, desktop), and device filters, for example for privileged access workstations.
Access controls (decisions)
Block
The most restrictive decision.
Grant
With no controls or requiring one or more:
- MFA
- Authentication strength
- Device marked as compliant
- Hybrid joined device
- Approved client app or app protection policy
- Password change
- Terms of use
Session
Limited experiences inside specific apps. Conditional Access App Control uses Defender for Cloud Apps signals to block download, cut, copy, and print of sensitive documents or require them to be labeled. Also sign-in frequency and app-enforced restrictions.
Authentication strength
A grant control that defines which combinations of methods work for a resource. It lets you require strong methods for sensitive resources and less restrictive ones for everyday access. There are three built-in strengths and you can create custom ones:
MFA
Any combination that satisfies MFA, including a password plus SMS, voice, push, or OATH.
Passwordless MFA
Methods that satisfy MFA without a password: Authenticator (phone sign-in), FIDO2 keys, Windows Hello for Business, or platform credentials.
Phishing-resistant MFA
Methods that require an interaction between the method and the sign-in surface: Windows Hello for Business, FIDO2 keys, and multifactor CBA.
Common policies
The most common access concerns Conditional Access solves, according to Microsoft:
- Requiring MFA for users with administrative roles
- Requiring MFA for Azure management tasks
- Blocking sign-ins that use legacy authentication protocols
- Requiring trusted locations for security info registration
- Blocking or granting access from specific locations
- Blocking risky sign-in behaviors
- Requiring organization-managed devices for specific apps
AI services: Microsoft 365 Copilot and Security Copilot are protected the same way. For example: require phishing-resistant MFA for generative AI users, require a compliant device when insider risk is moderate, or block access when it's elevated.
Licensing and operations
License
Requires Microsoft Entra ID P1 (included in Microsoft 365 Business Premium). Risk-based policies require ID Protection, which is P2. Free-only tenants use security defaults.
If the license expires
Policies aren't automatically disabled or deleted, so the security posture doesn't change abruptly. They can be viewed and deleted, but not updated.
Report-only and What If
Policies can be enabled or in report-only mode, and the policies page lets you simulate "What If" scenarios before applying changes.
Conditional Access Optimization Agent
A Security Copilot agent that suggests new policies and changes based on Zero Trust and best practices. It needs at least P1 and security compute units (SCU).
Global Secure Access
It's Microsoft's Security Service Edge (SSE) solution, built on Zero Trust. It combines Internet Access, Internet Access for Microsoft Services, and Private Access with Defender for Cloud Apps to bring network, identity, and endpoint controls together. It helps reduce lateral movement through a compromised VPN tunnel, put a perimeter around internet-facing assets, and improve service in branch offices. A client on the device routes traffic profiles through the service, integrated with Conditional Access.
Microsoft Entra Internet Access
An identity-centric secure web gateway (SWG) for SaaS and internet traffic. Requires Microsoft Entra Suite or a standalone license.
- Web content filtering by category and domain
- Universal Conditional Access, even for destinations not federated with Entra
- TLS inspection and threat intelligence
- Prompt injection protection for AI services
- Universal CAE: adjusts or blocks access in near real time if something changes
Internet Access for Microsoft Services
A Microsoft 365 traffic profile (Exchange, SharePoint, Teams): compliant network check against token theft, universal tenant restrictions against exfiltration to foreign tenants, source IP restoration, and enriched logs. Included with Entra ID P1 or P2.
Microsoft Entra Private Access
Replaces legacy VPNs with Zero Trust Network Access (ZTNA): per-app access, not access to the whole network. A network connector brokers traffic. It's configured with Quick Access (resources by FQDN, IP, or range in a single app) or per-app access (each app with its own resources and policies), and App Discovery finds private apps in use.
For AI, GSA adds shadow AI discovery (unauthorized AI apps) and network controls for agent traffic.
Entra roles and RBAC
Entra roles control permissions to manage Entra resources, like creating accounts or viewing billing. Managing access with roles is called role-based access control: Microsoft Entra RBAC.
Built-in roles
Fixed bundles of permissions that can't be modified. Examples: Global Administrator (everything; whoever creates the tenant gets it), User Administrator (users and groups, support tickets, and service health), Billing Administrator (purchases, subscriptions, and tickets).
Custom roles
You pick permissions from the same list the built-in roles use. Two steps: create the definition and assign it at a scope, which can be the whole organization or an object (for example, a single app). Requires P1 or P2.
Entra-specific
Manage only Entra resources: User, Application, and Groups Administrator.
Service-specific
For Microsoft 365 services: Exchange, Intune, SharePoint, and Teams Administrator.
Cross-service
Span several services: Security Administrator, Compliance Administrator.
Some services, like Exchange and Intune, also have their own RBAC; others, like Teams and SharePoint, use Entra roles.
| Microsoft Entra RBAC | Azure RBAC | |
|---|---|---|
| Controls | Entra resources: users, groups, applications | Azure resources: VMs, storage, via Azure Resource Manager |
| Example | User Administrator | Contributor on a resource group |
| Where stored and evaluated | Its own data store and decision point | A different data store and decision point |
Least privilege
If someone only manages users, give them User Administrator, not Global Administrator: it limits the damage if the account is compromised. It matters even more with AI services that process large amounts of data with the user's permissions.
Exam scenarios
| Need | Answer | Why |
|---|---|---|
| Require MFA only for users with admin roles | Policy assigned to directory roles with the MFA control | It's one of the common policies. |
| Block legacy authentication protocols | Policy with the client apps condition and the Block control | It's a common policy; security defaults also enforce it. |
| Require a secure password change when user risk is high | Risk-based Conditional Access | Requires ID Protection (P2). |
| Allow viewing documents but not downloading them on unmanaged devices | Session control (App Control) | It uses Defender for Cloud Apps. |
| Test a policy's effect before enabling it | Report-only mode / What If | It shows what would happen without enforcing the policy. |
| Give access to private apps without a VPN | Microsoft Entra Private Access | ZTNA with per-app access. |
| A technician should only manage users and groups | User Administrator role | Least privilege instead of Global Administrator. |
| A permission to manage only one specific app | Custom role with object scope | Requires P1. |
Common exam traps
❓ A policy is assigned to a group and an app. A group member signs in to a different app. Does it apply?
No. Assignments are combined with AND: all must be met.
❓ You want to stop users from downloading documents on unmanaged devices but still let them view them. Which control?
A session control (Conditional Access App Control with Defender for Cloud Apps). Block would prevent all access.
❓ Is Conditional Access evaluated before the password?
No. It applies after first-factor authentication.
❓ What replaces a traditional VPN with per-app access?
Microsoft Entra Private Access (ZTNA). Internet Access is the secure web gateway for internet and SaaS traffic.
❓ Does an Entra role like Global Administrator grant access to Azure VMs?
Not directly. Entra roles control Entra resources; VMs are controlled with Azure RBAC.
❓ Does requiring MFA guarantee a phishing-resistant method?
No. Use the phishing-resistant authentication strength for that; MFA accepts a password plus SMS.
❓ Which license includes Internet Access for Microsoft Services?
Entra ID P1 or P2. Full Internet Access requires Entra Suite or its own license.
Did you get this topic?
Test what you just learned
A company wants access to a finance app allowed only with Windows Hello for Business, FIDO2 keys, or certificates. What does it configure in Conditional Access?
Ready to test "Conditional Access, GSA, and roles"?
Original questions, each with a full explanation.
Start a mock exam