📋 Microsoft Entra Documentation Changes

title: What is Conditional Access in Microsoft Entra ID?

description: Conditional Access is the Zero Trust policy engine at the heart of the new identity-driven control plane.

ms.date: 07/01/2025

Administrators are faced with two primary goals:

title: 'Conditional Access: Target Resources Overview'

ms.topic: how-to

ms.date: 07/25/2025

ms.author: joflore

author: MicrosoftGuyJFlo

manager: dougeby

ms.reviewer: lhuangnorth

title: Conditions in Conditional Access policy

description: What are conditions in a Microsoft Entra Conditional Access policy?

ms.topic: article

ms.date: 03/12/2025

Within a Conditional Access policy, an administrator can use one or more signals to enhance their policy decisions.

Multiple conditions can be combined to create fine-grained and specific Conditional Access policies.

title: Network in Conditional Access policy

description: Using network locations as assignments in a Microsoft Entra Conditional Access policy

ms.date: 04/28/2025

Administrators can create policies that target specific network locations as a signal along with other conditions in their decision making process. They can include or exclude these network locations as part of their policy configuration. These network locations might include public IPv4 or IPv6 network information, countries/regions, unknown areas that don't map to specific countries/regions, or [Global Secure Access' compliant network](../../global-secure-access/how-to-compliant-network.md).

:::image type="content" source="media/common-conditional-access-media/conditional-access-signal-decision-enforcement.png" alt-text="Diagram that shows the concept of Conditional Access signals and the decision to enforce organizational policy." lightbox="media/common-conditional-access-media/conditional-access-signal-decision-enforcement.png":::

> Conditional Access policies are enforced after first-factor authentication completes. Conditional Access isn't intended to be an organization's frontline of defense for scenarios like denial-of-service (DoS) attacks, but it can use signals from these events to determine access.

title: Session controls in Conditional Access policy

description: What are session controls in a Microsoft Entra Conditional Access policy

ms.date: 08/20/2025

ms.reviewer:

Within a Conditional Access policy, an administrator can make use of session controls to enable limited experiences within specific cloud applications.


title: Configure Users, Groups, and Workload Identities in Conditional Access

description: Configure Conditional Access user assignments in Microsoft Entra ID. Target specific users, groups, directory roles, and workload identities while avoiding administrator lockout with proper exclusions.

ms.topic: article

ms.date: 07/21/2025

A Conditional Access policy must include a user, group, or workload identity assignment as one of the signals in the decision process. These identities can be included or excluded from Conditional Access policies. Microsoft Entra ID evaluates all policies and ensures that all requirements are met before granting access.

This list of users typically includes all of the users an organization is targeting in a Conditional Access policy.

The following options are available to include when creating a Conditional Access policy.

author: billmath

ms.date: 11/11/2022

ms.author: billmath

ms.custom: include file

1. Sign in to the [Azure portal](https://portal.azure.com).

1. Select **Microsoft Entra ID**.

1. Select **Microsoft Entra Connect**, and then select **Cloud Sync**.

author: billmath

ms.topic: include

ms.date: 01/23/2022

ms.author: billmath

ms.custom: include file

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [hybrid identity administrator](~/identity/role-based-access-control/permissions-reference.md#hybrid-identity-administrator).

:::image type="content" source="media/cloud-sync-sign-in/sign-in-1.png" alt-text="Screenshot that shows the Microsoft Entra Connect Cloud Sync home page." lightbox="media/cloud-sync-sign-in/sign-in-1.png":::

#### Add Steering Configuration for Internet Access and Private Apps

1. Under **Cloud, Web and Firewall** > **Web Traffic.**

1. **Bypass exception traffic at** > **Client.**

1. Under **Private Apps**, select **Specific Private Apps**.

1. Select the `MSFTSSEPrivate` configuration > **Exceptions** > **New Exception** > **Destination Locations** > Select `MSFT SSE Service` and `MSFT SSE M365` (Instructions for creating this object are listed in the Netskope profiles section).

1. Select **Bypass** and **Treat it like local IP address** options.

1. Select **Exceptions** > **New Exception** > **Domains** and add these exceptions: `*.globalsecureaccess.microsoft.com`, `*.auth.microsoft.com`, `*.msftidentity.com`, `*.msidentity.com`, `*.onmicrosoft.com`, `*.outlook.com`, `*.protection.outlook.com`, `*.sharepoint.com`, `*.sharepointonline.com`, `*.svc.ms`, `*.wns.windows.com`, `account.activedirectory.windowsazure.com`, `accounts.accesscontrol.windows.net`, `admin.onedrive.com`, `adminwebservice.microsoftonline.com`, `api.passwordreset.microsoftonline.com`, `autologon.microsoftazuread-sso.com`, `becws.microsoftonline.com`, `ccs.login.microsoftonline.com`, `clientconfig.microsoftonline-p.net`, `companymanager.microsoftonline.com`, `device.login.microsoftonline.com`, `g.live.com`, `graph.microsoft.com`, `graph.windows.net`, `login-us.microsoftonline.com`, `login.microsoft.com`, `login.microsoftonline-p.com`, `login.microsoftonline.com`, `login.windows.net`, `logincert.microsoftonline.com`, `loginex.microsoftonline.com`, `nexus.microsoftonline-p.com`, `officeclient.microsoft.com`, `oneclient.sfx.ms`, `outlook.cloud.microsoft`, `outlook.office.com`, `outlook.office365.com`, `passwordreset.microsoftonline.com`, `provisioningapi.microsoftonline.com`, `spoprod-a.akamaihd.net`.

1. Select **Add Steered Item** > Select **Private App** and select the private applications for Netskope to steer > **Add**.

Administrators can choose to enforce one or more controls when granting access. These controls include the following options:

When administrators choose to combine these options, they can use the following methods:

Administrators can choose to require [specific authentication strengths](~/identity/authentication/concept-authentication-strengths.md) in their Conditional Access policies. These authentication strengths are defined in the **Microsoft Entra admin center** > **Entra ID** > **Authentication methods** > **Authentication strengths**. Administrators can choose to create their own or use the built-in versions.

 

3. Select **New configuration**

4. On the configuration screen, enter a **Notification email**, move the selector to **Enable** and select **Save**.

5. The configuration status should now be **Healthy**.

For more information on configuring Microsoft Entra Cloud Sync, see [Provision Active Directory to Microsoft Entra ID](/entra/identity/hybrid/cloud-sync/how-to-configure).

3. Verify that you see the new users in our tenant

1. Browse to **Entra ID** > **Enterprise apps** > **App management policies**.

1. Browse to **Entra ID** > **Enterprise apps** > **App management policies**.

1. Browse to **Entra ID** > **Enterprise apps** > **App management policies**.

1. In the Azure portal, select **Microsoft Entra ID**.

1. On the left pane, select **Microsoft Entra Connect**, and then select **Cloud Sync**.

> You can only configure threat intelligence policy per security profile. Rule priorities within each security control handle exceptions, and security controls follow the ordering, (1) TLS inspection > (2) Web content filtering > (3) Threat intelligence > (4) File type > (6) Data loss prevention > (7) Third-party