You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In a mobile-first, cloud-first world, users can access your organization's resources from anywhere using different kinds of devices and apps. As a result, just focusing on who can access a resource is no longer enough. You can control who has access and identify where the user is and what device is being used and much more.
21
21
22
-
To provide this control, **Azure Active Directory (AD) Conditional Access** allows you to specify the conditions any user must meet for access to an application, such as Multi-Factor Authentication (MFA). Using Conditional Access policies controls how authorized users (users that have been granted access to a cloud app) access cloud apps under specific conditions. Refer to [What is Conditional Access in Azure Active Directory](overview.md#conditional-access-policies) for more information.
22
+
To provide this control, **Azure Active Directory (AD) Conditional Access** allows you to specify the conditions any user must meet for access to an application, such as Multi-Factor Authentication (MFA). Using Conditional Access policies controls how authorized users (users that have been granted access to a cloud app) access cloud apps under specific conditions. Refer to [What is Conditional Access in Azure Active Directory](overview.md) for more information.
title: What is Conditional Access in Azure Active Directory? | Microsoft Docs
3
-
description: Learn how Conditional Access in Azure Active Directory helps you to implement automated access decisions that are not only based on who tries to access a resource but also how a resource is accessed.
2
+
title: What is Conditional Access in Azure Active Directory?
3
+
description: Learn how Conditional Access is at the heart of the new identity driven control plane.
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: conditional-access
8
8
ms.topic: overview
9
-
ms.date: 02/14/2019
9
+
ms.date: 09/17/2019
10
10
11
11
ms.author: joflore
12
12
author: MicrosoftGuyJFlo
13
13
manager: daveba
14
14
ms.reviewer: calebb
15
15
16
-
#Customer intent: As an IT admin, I want to understand Conditional Access well enough so that I can control how users are accessing my resources.
17
16
ms.collection: M365-identity-device-management
18
17
---
19
18
# What is Conditional Access?
20
19
21
-
Security is a top concern for organizations using the cloud. A key aspect of cloud security is identity and access when it comes to managing your cloud resources. In a mobile-first, cloud-first world, users can access your organization's resources using a variety of devices and apps from anywhere. As a result of this, just focusing on who can access a resource is not sufficient anymore. To master the balance between security and productivity, you also need to factor how a resource is accessed into an access control decision. With Azure Active Directory (Azure AD) Conditional Access, you can address this requirement. Conditional Access is a capability of Azure Active Directory. With Conditional Access, you can implement automated access control decisions for accessing your cloud apps that are based on conditions.
20
+
The modern security perimeter now extends beyond an organization's network to include user and device identity. Organizations can utilize these identity signals as part of their access control decisions.
22
21
23
-
Conditional Access policies are enforced after the first-factor authentication has been completed. Therefore, Conditional Access is not intended as a first line defense for scenarios like denial-of-service (DoS) attacks, but can utilize signals from these events (for example, the sign-in risk level, location of the request, and so on) to determine access.
22
+
Conditional Access is the tool used by Azure Active Directory to bring signals together, to make decisions, and enforce organizational policies. Conditional Access is at the heart of the new identity driven control plane.
24
23
25
-
24
+
26
25
27
-
This article provides you with a conceptual overview of Conditional Access in Azure AD.
26
+
Conditional Access policies at their simplest are if-then statements, if a user wants to access a resource, then they must complete an action. Example: A payroll manager wants to access the payroll application and is required to perform multi-factor authentication to access it.
28
27
29
-
## Common scenarios
30
-
31
-
In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, apps, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and third-party SaaS apps, you are faced with two opposing goals:
28
+
Administrators are faced with two primary goals:
32
29
33
30
- Empower users to be productive wherever and whenever
34
-
- Protect the corporate assets at any time
35
-
36
-
By using Conditional Access policies, you can apply the right access controls under the required conditions. Azure AD Conditional Access provides you with added security when needed and stays out of your user’s way when it isn’t.
37
-
38
-
Following are some common access concerns that Conditional Access can help you with:
39
-
40
-
-**[Sign-in risk](conditions.md#sign-in-risk)**: Azure AD Identity Protection detects sign-in risks. How do you restrict access if a detected sign-in risk indicates a bad actor? What if you would like to get stronger evidence that a sign-in was performed by the legitimate user? What if your doubts are strong enough to even block specific users from accessing an app?
41
-
-**[Network location](location-condition.md)**: Azure AD is accessible from anywhere. What if an access attempt is performed from a network location that is not under the control of your IT department? A username and password combination might be good enough as proof of identity for access attempts from your corporate network. What if you demand a stronger proof of identity for access attempts that are initiated from other unexpected countries or regions of the world? What if you even want to block access attempts from certain locations?
42
-
-**[Device management](conditions.md#device-platforms)**: In Azure AD, users can access cloud apps from a broad range of devices including mobile and also personal devices. What if you demand that access attempts should only be performed with devices that are managed by your IT department? What if you even want to block certain device types from accessing cloud apps in your environment?
43
-
-**[Client application](conditions.md#client-apps)**: Today, you can access many cloud apps using different app types such as web-based apps, mobile apps, or desktop apps. What if an access attempt is performed using a client app type that causes known issues? What if you require a device that is managed by your IT department for certain app types?
44
-
45
-
These questions and the related answers represent common access scenarios for Azure AD Conditional Access.
46
-
Conditional Access is a capability of Azure Active Directory that enables you to handle access scenarios using a policy-based approach.
A Conditional Access policy is a definition of an access scenario using the following pattern:
33
+
By using Conditional Access policies, you can apply the right access controls when needed to keep your organization secure and stay out of your user’s way when not needed.
53
34
54
-
35
+
55
36
37
+
Conditional Access policies are enforced after the first-factor authentication has been completed. Conditional Access is not intended as an organization's first line of defense for scenarios like denial-of-service (DoS) attacks, but can use signals from these events to determine access.
56
38
57
-
**When this happens** defines the reason for triggering your policy. This reason is characterized by a group of conditions that have been satisfied. In Azure AD Conditional Access, the two assignment conditions play a special role:
39
+
## Common signals
58
40
59
-
-**[Users](conditions.md#users-and-groups)**: The users performing an access attempt (**Who**).
60
-
-**[Cloud apps](conditions.md#cloud-apps-and-actions)**: The targets of an access attempt (**What**).
41
+
Common signals that Conditional Access can take in to account when making a policy decision include the following signals:
61
42
62
-
These two conditions are mandatory in a Conditional Access policy. In addition to the two mandatory conditions, you can also include additional conditions that describe how the access attempt is performed. Common examples are using mobile devices or locations that are outside your corporate network. For more information, see [Conditions in Azure Active Directory Conditional Access](conditions.md).
43
+
- User or group membership
44
+
- Policies can be targeted to specific users and groups giving administrators fine-grained control over access.
45
+
- IP Location information
46
+
- Organizations can create trusted IP address ranges that can be used when making policy decisions.
47
+
- Administrators can specify entire countries IP ranges to block or allow traffic from.
48
+
- Device
49
+
- Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.
50
+
- Application
51
+
- Users attempting to access specific applications can trigger different Conditional Access policies.
52
+
- Real-time and calculated risk detection
53
+
- Signals integration with Azure AD Identity Protection allows Conditional Access policies to identify risky sign-in behavior. Policies can then force users to perform password changes or multi-factor authentication to reduce their risk level or be blocked from access until an administrator takes manual action.
54
+
- Microsoft Cloud App Security (MCAS)
55
+
- Enables user application access and sessions to be monitored and controlled in real time, increasing visibility and control over access to and activities performed within your cloud environment.
63
56
64
-
The combination of conditions with your access controls represents a Conditional Access policy.
57
+
## Common decisions
65
58
66
-
59
+
- Block access
60
+
- Most restrictive decision
61
+
- Grant access
62
+
- Least restrictive decision, can still require one or more of the following options:
63
+
- Require multi-factor authentication
64
+
- Require device to be marked as compliant
65
+
- Require Hybrid Azure AD joined device
66
+
- Require approved client app
67
+
- Require app protection policy (preview)
67
68
68
-
With Azure AD Conditional Access, you can control how authorized users can access your cloud apps. The objective of a Conditional Access policy is to enforce additional access controls on an access attempt to a cloud app based on how an access attempt is performed.
69
+
## Commonly applied policies
69
70
70
-
A policy-based approach to protect access to your cloud apps enables you to start drafting the policy requirements for your environment using the structure outlined in this article without worrying about the technical implementation.
71
+
Many organizations have common access concerns that Conditional Access policies can help with such as:
71
72
72
-
## Azure AD Conditional Access and federated authentication
73
-
74
-
Conditional Access policies work seamlessly with [federated authentication](../../security/fundamentals/choose-ad-authn.md#federated-authentication). This support includes all supported conditions and controls and visibility into how policy is applied to active user sign-ins using [Azure AD reporting](../reports-monitoring/concept-sign-ins.md).
75
-
76
-
*Federated authentication with Azure AD* means that a trusted authentication service handles user authentication to Azure AD. A trusted authentication service is, for example, Active Directory Federation Services (AD FS), or any other federation service. In this configuration, primary user authentication is performed at the service and then Azure AD is used to sign into individual applications. Azure AD Conditional Access is applied before access is granted to the application the user is accessing.
77
-
78
-
When the configured Conditional Access policy requires multi-factor authentication, Azure AD defaults to using Azure MFA. If you use the federation service for MFA, you can configure Azure AD to redirect to the federation service when MFA is needed by setting `-SupportsMFA` to `$true` in [PowerShell](https://docs.microsoft.com/powershell/module/msonline/set-msoldomainfederationsettings). This setting works for federated authentication services that support the MFA challenge request issued by Azure AD using `wauth= http://schemas.microsoft.com/claims/multipleauthn`.
79
-
80
-
After the user has signed in to the federated authentication service, Azure AD handles other policy requirements such as device compliance or an approved application.
73
+
- Requiring multi-factor authentication for users with administrative roles
74
+
- Requiring multi-factor authentication for Azure management tasks
75
+
- Blocking sign-ins for users attempting to use legacy authentication protocols
76
+
- Requiring trusted locations for Azure Multi-Factor Authentication registration
77
+
- Blocking or granting access from specific locations
78
+
- Blocking risky sign-in behaviors
79
+
- Requiring organization-managed devices for specific applications
81
80
82
81
## License requirements
83
82
@@ -88,3 +87,9 @@ Customers with [Microsoft 365 Business licenses](https://docs.microsoft.com/offi
88
87
## Next steps
89
88
90
89
To learn how to implement Conditional Access in your environment, see [Plan your Conditional Access deployment in Azure Active Directory](plan-conditional-access.md).
90
+
91
+
[Learn about Identity Protection](../identity-protection/overview-v2.md)
92
+
93
+
[Learn about Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security)
94
+
95
+
[Learn about Microsoft Intune](https://docs.microsoft.com/intune/index)
0 commit comments