What are Conditional Access Policies?
Conditional Access Policies (CAPs) are identity-driven policies that govern user access to resources. We can summarize them as if statements that govern what will be requested, enforced or blocked.
In most organizations, the CAPs govern the enforcement of MFA, the block of logins using legacy protocols, and requiring a compliant device to access company resources.
All policies “think” at the user level.
It is advisable to make changes to CAPs only if you have a basic understatement of the service, since you could risk blocking access to the tenant for all users. In order to learn more, refer to the following documentation:
Azure AD Conditional Access documentation – Microsoft Entra | Microsoft Learn
General considerations
- It’s a good idea to manage exclusions using Groups. This way, you won’t have to directly modify the policy every time.
- Since many policies are scoped to include all users, you’ll have to handle exceptions with the “exclude” feature.
How to add or remove a user
- Log in to Conditional Access – Microsoft Azure
- Select the desired policy
- If you intend to add a user to the policy, click on the blue link under “Users or workload identities”, then “Include,” and click the blue link under “Users and groups”.
- Select or search for the desired user, then click “Select.”
- If you want to exclude a user, click on the blue link under “Users or workload identities”, then “Exclude,” and click on the blue link just below “Users and groups.” The same user selection screen shown in the previous step will open. Search for and select the user, then click “Select.”
Once done, save using the “Save” button at the end of the page. If the policy is in “Report-only” or “Off“, the flow is not active.
Azvise 