You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/plan-conditional-access.md
+4-9Lines changed: 4 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,7 +45,7 @@ Microsoft provides [security defaults](../fundamentals/concept-fundamentals-secu
45
45
46
46
## Conditional Access policy components
47
47
48
-
Conditional Access policies answer questions about who should access your resources, what resources they should access, and under what conditions. Policies can be designed to grant access, limit access with session controls, or to block access. You [build a Conditional Access policy](concept-conditional-access-policies.md) by defining the if-then statements like:
48
+
Conditional Access policies answer questions about who can access your resources, what resources they can access, and under what conditions. Policies can be designed to grant access, limit access with session controls, or to block access. You [build a Conditional Access policy](concept-conditional-access-policies.md) by defining the if-then statements like:
49
49
50
50
| If an assignment is met | Apply the access controls |
51
51
| --- | --- |
@@ -177,7 +177,7 @@ If you rely on a single access control such as multifactor authentication or a n
177
177
178
178

179
179
180
-
**Example**; A policy to require MFA for marketing users accessing the Dynamics CRP app from external networks might be:
180
+
**Example**: A policy to require MFA for marketing users accessing the Dynamics CRP app from external networks might be:
@@ -191,9 +191,7 @@ In addition to your active policies, implement disabled policies that act as sec
191
191
* The name of disruption it should apply to.
192
192
* An ordering sequence number to help the administrator to know in which order policies should be enabled.
193
193
194
-
**Example**
195
-
196
-
The following name indicates that this policy is the first of four policies to enable if there's an MFA disruption:
194
+
**Example**: The following name indicates that this policy is the first of four policies to enable if there's an MFA disruption:
197
195
198
196
* EM01 - ENABLE IN EMERGENCY: MFA Disruption [1/4] - Exchange SharePoint: Require hybrid Azure AD join For VIP users.
199
197
@@ -211,14 +209,11 @@ Refer to [Conditional Access policy templates](concept-conditional-access-policy
211
209
212
210
#### Evaluate the policy impact
213
211
214
-
We recommend that you use the following tools to evaluate the impact of your policies both before and after making changes.
212
+
We recommend that you use the following tools to evaluate the impact of your policies both before and after making changes. A simulated run gives you a good idea of the impact a Conditional Access policy has, it does not replace an actual test run in a properly configured development environment.
215
213
216
214
-[Report-only mode](concept-conditional-access-report-only.md) and the Conditional Access insights and Reporting workbook.
217
215
- The [What If tool](concept-conditional-access-policies.md)
218
216
219
-
> [!IMPORTANT]
220
-
> While a simulated run gives you a good idea of the impact a Conditional Access policy has, it does not replace an actual test run in a properly configured development environment.
221
-
222
217
### Test your policies
223
218
224
219
**Ensure you test the exclusion criteria of a policy**. For example, you may exclude a user or group from a policy that requires MFA. Test if the excluded users are prompted for MFA, because the combination of other policies might require MFA for those users.
0 commit comments