Skip to content

Commit 18edc41

Browse files
WIP
1 parent 3176c51 commit 18edc41

File tree

1 file changed

+4
-9
lines changed

1 file changed

+4
-9
lines changed

articles/active-directory/conditional-access/plan-conditional-access.md

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Microsoft provides [security defaults](../fundamentals/concept-fundamentals-secu
4545

4646
## Conditional Access policy components
4747

48-
Conditional Access policies answer questions about who should access your resources, what resources they should access, and under what conditions. Policies can be designed to grant access, limit access with session controls, or to block access. You [build a Conditional Access policy](concept-conditional-access-policies.md) by defining the if-then statements like:
48+
Conditional Access policies answer questions about who can access your resources, what resources they can access, and under what conditions. Policies can be designed to grant access, limit access with session controls, or to block access. You [build a Conditional Access policy](concept-conditional-access-policies.md) by defining the if-then statements like:
4949

5050
| If an assignment is met | Apply the access controls |
5151
| --- | --- |
@@ -177,7 +177,7 @@ If you rely on a single access control such as multifactor authentication or a n
177177

178178
![Screenshot that shows the naming standards for policies.](media/plan-conditional-access/11.png)
179179

180-
**Example**; A policy to require MFA for marketing users accessing the Dynamics CRP app from external networks might be:
180+
**Example**: A policy to require MFA for marketing users accessing the Dynamics CRP app from external networks might be:
181181

182182
![Naming standard](media/plan-conditional-access/naming-example.png)
183183

@@ -191,9 +191,7 @@ In addition to your active policies, implement disabled policies that act as sec
191191
* The name of disruption it should apply to.
192192
* An ordering sequence number to help the administrator to know in which order policies should be enabled.
193193

194-
**Example**
195-
196-
The following name indicates that this policy is the first of four policies to enable if there's an MFA disruption:
194+
**Example**: The following name indicates that this policy is the first of four policies to enable if there's an MFA disruption:
197195

198196
* EM01 - ENABLE IN EMERGENCY: MFA Disruption [1/4] - Exchange SharePoint: Require hybrid Azure AD join For VIP users.
199197

@@ -211,14 +209,11 @@ Refer to [Conditional Access policy templates](concept-conditional-access-policy
211209

212210
#### Evaluate the policy impact
213211

214-
We recommend that you use the following tools to evaluate the impact of your policies both before and after making changes.
212+
We recommend that you use the following tools to evaluate the impact of your policies both before and after making changes. A simulated run gives you a good idea of the impact a Conditional Access policy has, it does not replace an actual test run in a properly configured development environment.
215213

216214
- [Report-only mode](concept-conditional-access-report-only.md) and the Conditional Access insights and Reporting workbook.
217215
- The [What If tool](concept-conditional-access-policies.md)
218216

219-
> [!IMPORTANT]
220-
> While a simulated run gives you a good idea of the impact a Conditional Access policy has, it does not replace an actual test run in a properly configured development environment.
221-
222217
### Test your policies
223218

224219
**Ensure you test the exclusion criteria of a policy**. For example, you may exclude a user or group from a policy that requires MFA. Test if the excluded users are prompted for MFA, because the combination of other policies might require MFA for those users.

0 commit comments

Comments
 (0)