Unit 7: Use Conditional Access with Global Secure Access

Global Secure Access introduces new Conditional Access checks.

New Conditional Access Capabilities

These features require Global Secure Access signaling to be enabled.

Compliant Network Enforcement

Compliant network checks occur:

• At authentication time.
• During sessions using CAE.

This prevents:

• Token replay attacks.
• Cross-tenant misuse.
• Access from unauthorized networks.

Source IP Restoration

Source IP restoration ensures:

• Original user IP is visible in logs.
• Identity Protection risk calculations remain accurate.
• Existing IP-based policies continue to function.

User Exclusions

Always exclude:

• Emergency access accounts.
• Service accounts and sync identities.