@@ -0,0 +1,100 @@+---+title: Create a Conditional Access policy plan (preview)+description: Learn how to create a Conditional Access policy plan from a template or from scratch in the Microsoft Entra admin center.++ms.service: entra-id+ms.subservice: conditional-access+ms.topic: how-to+ms.date: 10/21/2026++ms.author: etbasser+author: ebasseri+ms.reviewer: celested+ai-usage: ai-assisted+#customer intent: As a Conditional Access administrator, I want to create a policy plan so that I can manage shared targeting and exclusions across related rules.+---+# Create a Microsoft Entra Conditional Access policy plan (preview)++This article shows you how to create a Conditional Access policy plan in the Microsoft Entra admin center, either from a built-in template or from scratch. For background on how plans work and why to use them, see [What are Conditional Access policy plans?](concept-conditional-access-policy-plans.md).++Before you create a plan, identify its security objective. For example, a plan might protect employees at a specific location, secure agent activity, or require compliant devices. Add only the assignments and conditions that apply to every scenario to the plan's shared conditions. Configure variations of the objective as individual rules.++> [!IMPORTANT]+> Conditional Access policy plans are in preview. Preview features are available under the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) and might not have all the capabilities of generally available features.++## Prerequisites++To create, modify, or delete a policy plan, sign in with the Conditional Access Administrator role.++For license requirements, see [Conditional Access license requirements](overview.md#license-requirements).++Before you begin, read [What are Conditional Access policy plans?](concept-conditional-access-policy-plans.md) to understand how shared conditions and rules interact.++## User exclusions++Conditional Access policies are powerful tools. We recommend excluding the following accounts from your policies:++- **Emergency access** accounts to prevent lockout because of policy misconfiguration. In the unlikely scenario where all administrators are locked out, your emergency access administrative account can be used to sign in and recover access. For more information, see [Manage emergency access accounts in Microsoft Entra ID](../role-based-access-control/security-emergency-access.md).+- **Service accounts** and **service principals**, such as the Microsoft Entra Connect Sync Account. Service accounts are noninteractive accounts that aren't tied to a specific user. They're typically used by back-end services to allow programmatic access to applications. Calls made by service principals aren't blocked by Conditional Access policies scoped to users. Use [Conditional Access for workload identities](workload-identity.md) to define policies that target service principals.++> [!TIP]+> With policy plans, add emergency access accounts and service accounts to the plan's **shared conditions** exclusion list instead of repeating them in each rule. Exclusions set at the plan level apply to every rule automatically and can't be removed by an individual rule.++## Create a policy plan from a template++Templates provide preconfigured shared conditions and rules for common Conditional Access scenarios, including plans that secure agent activity. Starting from a template creates the plan, shared conditions, and one or more rules in a single flow.++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).+1. Browse to **Entra ID** > **Conditional Access** > **Policy plans (Preview)**.+1. Select **Create policy from template**.+1. Browse the available templates, select **Use template** for one or more templates, and then select **Create plan**.+1. On the **Create plan from templates** tab, customize the name if needed. Under **Shared conditions**, review any prepopulated targeting, and then select **Create policy plan**. The initial **State** for all rules generated by a template is **Off** to prevent unintended impact to your organization.+1. After the plan is created, select **Edit plan**. Select **Add Users** > **Exclude** to add your organization's emergency access accounts and any service accounts that must be excluded from every rule in the plan. Modify any other shared conditions as needed.+1. In the **Rules** list, review the prepopulated rules. Select a rule to edit its name, conditions, or grant controls. Each rule is evaluated independently at sign-in time.+1. For each rule, change **State** from **Off** to **Report-only**. Report-only mode lets you validate the effect in sign-in logs before enforcement begins.++After you review the effect by using [report-only mode](concept-conditional-access-report-only.md), return to each rule, set **State** to **On**, and save your changes.++## Create a custom policy plan++Build a plan from scratch when your scenario isn't covered by a template, or when you want full control over shared conditions and rules from the start.++### Create the plan++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).+1. Browse to **Entra ID** > **Conditional Access** > **Policy plans (Preview)**, and then select **Create policy**.+1. On the **Create policy plan** tab, enter a name. Optionally, add a description and tags. Your account is automatically added as an owner. Add other individual or group owners as needed to record accountability. The owner field is for accountability only and doesn't grant permissions to policy plans.++### Configure shared conditions++Shared conditions are optional and apply to every rule in the plan.++> [!NOTE]+> Add only assignments and conditions that apply to every rule to shared conditions. Configure anything that varies by scenario in the individual rules. You can add exclusions at the rule level, but you can't remove or override exclusions set in shared conditions. Identity type must be consistent. A plan that targets users at the plan level can't also target workload identities at the plan level.++1. Under **Add users, agents or workload identities**, select the identities to include or exclude that every rule in the plan should target. **All users** isn't available at the plan level. Exclude emergency access accounts and service accounts in shared conditions so the exclusions propagate to every rule.+1. Under **Add resources, user actions or authentication context**, optionally scope the plan to include or exclude a shared set of applications, actions, or contexts.+1. Under **Add condition**, optionally configure shared risk levels, device platforms, network locations, or client app types that should apply across all rules.+1. Select **Continue** to add your first rule.++### Add rules to the plan++Every plan must have at least one rule. Each rule inherits the plan's shared assignments and conditions, so you don't need to configure them again. The rule adds the assignments, conditions, and controls that are specific to its scenario.++1. Enter a name and optional description for the rule.+1. Under **State**, select **Report-only**.+1. Under **Add users, agents or workload identities**, select the identities to include or exclude.+1. Under **Add resources, user actions or authentication context**, scope the rule to include or exclude applications, actions, or contexts. Select **All resources** here when the rule should protect every resource.+1. Under **Add condition**, include conditions that should apply, or exclude specific device platforms, networks, or locations. These conditions combine with the plan's shared conditions at evaluation time.+1. Under **Add control** > **Grant**, select the grant controls to enforce when the rule matches.+1. Under **Add control** > **Session**, optionally configure session controls.+1. Review the plan and its initial rule, and then select **Create**.+1. Repeat these steps for each additional scenario. Each rule appears as an independent entry in sign-in logs.++After you review the impact with the built-in policy impact metrics or in sign-in logs by using [report-only mode](concept-conditional-access-report-only.md), return to each rule, set **State** to **On**, and save your changes.++## Next steps++- [What are Conditional Access policy plans?](concept-conditional-access-policy-plans.md)+- [Migrate Conditional Access policies to a policy plan](how-to-migrate-conditional-access-policy-plan.md)+- [Analyze Conditional Access policy impact](concept-conditional-access-report-only.md)