I’ve put a lot of effort into my Conditional Access policy design baseline, so if you are unsure how your policy design holds up, or how to get started, you can use that as a starting point. And even if you create one or two or three policies, everything you don’t explicitly block is allowed. In Conditional Access, everything is allowed by default. There is a feature called security defaults that kicks in if you have no policies configured but it is out of scope for this article, and security defaults is always disabled when you have one or more Conditional Access policies in place. About Conditional AccessĬonditional Access is a premium feature of Azure AD and it is disabled by default. In this blog post, I will show you why it is important to understand the Conditional Access policy evaluation process and how to find and exploit flaws in a policy design. But, if you don’t understand how Conditional Access works, it might bring you a false sense of security.

It’s no secret that I love working with Conditional Access and I truly believe that it should be the hearth and soul of every cloud enabled organisations zero trust strategy.

Conditional Access is one of Microsoft’s most powerful security features and the central engine for their zero trust architecture.

Azure security defaults