Unit 5: Implement Conditional Access Controls and Assignments

Sign-In Risk Policies

Sign-in risk measures how likely a sign-in is compromised. Available only with Entra ID Premium P2.

Actions:

• Require MFA.
• Require password change.
• Block access.

User Risk Policies

User risk measures likelihood that credentials are leaked. Based on intelligence from Microsoft and partners.

Securing Security Info Registration

Organizations can restrict where and how MFA and SSPR registration happens. For example, only allow registration from trusted locations.

Location-Based Access Control

Named locations allow you to:

• Block access from risky countries.
• Allow access only from trusted IP ranges.

Require Compliant Devices

Device compliance comes from Microsoft Intune.

Examples of compliance:

• Device encryption enabled.
• PIN required.
• OS version enforced.
• Device not rooted or jailbroken.

User Exclusions

Always exclude:

• Emergency access accounts.
• Service accounts.
• Service principals.
• Sync accounts.

Terms of Use (ToU)

Conditional Access can require users to:

• Read and accept Terms of Use.
• Reaccept updated or expired terms.

This is often used for:

• Legal compliance.
• External user access.