Merge pull request #51123 from wwlpublish/ae341bed5e38766e87ae095857f904a0e901ca52e6610d5d4b93657f1619c4af-live

v-ccolin · web-flow · commit 17a3b5cdd7cc · 2025-06-27T11:21:19.000+01:00
Modules/M03-plan-implement-administer-conditional-access
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/1-introduction.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/1-introduction.yml
@@ -6,7 +6,7 @@ metadata:
   prefetch-feature-rollout: true
   title: Introduction
   description: "Introduction"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/10-exercise-configure-authentication-session-controls.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/10-exercise-configure-authentication-session-controls.yml
@@ -6,13 +6,12 @@ metadata:
   prefetch-feature-rollout: true
   title: Exercise - Configure authentication session controls
   description: "Exercise - Configure authentication session controls"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
   ms.custom:
-    - sfi-ga-nochange
-    - N/A
+  - N/A
 durationInMinutes: 10
 content: |
   [!include[](includes/10-exercise-configure-authentication-session-controls.md)]
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/11-implement-continuous-access-evaluation.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/11-implement-continuous-access-evaluation.yml
@@ -1,17 +1,17 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.plan-implement-administer-conditional-access.implement-continuous-access-evaluation
-title: Implement continuous access evaluation
+title: Microsoft Entra Conditional Access Optimization agent
 metadata:
   adobe-target: true
   prefetch-feature-rollout: true
-  title: Implement continuous access evaluation
-  description: "Implement continuous access evaluation"
-  ms.date: 04/22/2025
+  title: Microsoft Entra Conditional Access Optimization agent
+  description: "Microsoft Entra Conditional Access Optimization agent"
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
   ms.custom:
   - N/A
-durationInMinutes: 3
+durationInMinutes: 10
 content: |
   [!include[](includes/11-implement-continuous-access-evaluation.md)]
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/12-knowledge-check.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/12-knowledge-check.yml
@@ -6,13 +6,12 @@ metadata:
   prefetch-feature-rollout: true
   title: Module assessment
   description: "Knowledge check"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
   ms.custom:
   - N/A
-  module_assessment: true
 durationInMinutes: 2
 content: |
   [!include[](includes/12-knowledge-check.md)]
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/13-summary-resources.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/13-summary-resources.yml
@@ -6,7 +6,7 @@ metadata:
   prefetch-feature-rollout: true
   title: Summary and resources
   description: "Summary and resources"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/2-plan-security-defaults.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/2-plan-security-defaults.yml
@@ -6,13 +6,12 @@ metadata:
   prefetch-feature-rollout: true
   title: Plan security defaults
   description: "Plan security defaults"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
   ms.custom:
-    - sfi-ga-nochange
-    - N/A
+  - N/A
 durationInMinutes: 2
 content: |
   [!include[](includes/2-plan-security-defaults.md)]
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/3-exercise-work-with-security-defaults.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/3-exercise-work-with-security-defaults.yml
@@ -6,7 +6,7 @@ metadata:
   prefetch-feature-rollout: true
   title: Exercise - Work with security defaults
   description: "Exercise - Work with security defaults"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/4-plan-conditional-access-policies.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/4-plan-conditional-access-policies.yml
@@ -6,13 +6,12 @@ metadata:
   prefetch-feature-rollout: true
   title: Plan Conditional Access policies
   description: "Plan Conditional Access policies"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
   ms.custom:
-    - sfi-ga-nochange
-    - N/A
+  - N/A
 durationInMinutes: 8
 content: |
   [!include[](includes/4-plan-conditional-access-policies.md)]
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/5-implement-conditional-access-policies-controls-assignments.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/5-implement-conditional-access-policies-controls-assignments.yml
@@ -6,7 +6,7 @@ metadata:
   prefetch-feature-rollout: true
   title: Implement Conditional Access policy controls and assignments
   description: "Implement Conditional Access policy controls and assignments"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/6-exercise-implement-conditional-access-policies-roles-assignments.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/6-exercise-implement-conditional-access-policies-roles-assignments.yml
@@ -6,13 +6,12 @@ metadata:
   prefetch-feature-rollout: true
   title: Exercise - Implement Conditional Access policies roles and assignments
   description: "Exercise - Implement Conditional Access policies roles and assignments"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
   ms.custom:
-    - sfi-ga-nochange
-    - N/A
+  - N/A
 durationInMinutes: 10
 content: |
   [!include[](includes/6-exercise-implement-conditional-access-policies-roles-assignments.md)]
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/7-test-troubleshooting-conditional-access-policies.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/7-test-troubleshooting-conditional-access-policies.yml
@@ -6,7 +6,7 @@ metadata:
   prefetch-feature-rollout: true
   title: Test and troubleshoot Conditional Access policies
   description: "Test and troubleshoot Conditional Access policies"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/8-implement-application-controls.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/8-implement-application-controls.yml
@@ -6,7 +6,7 @@ metadata:
   prefetch-feature-rollout: true
   title: Implement application controls
   description: "Implement application controls"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/9-implement-session-management.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/9-implement-session-management.yml
@@ -1,12 +1,12 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.plan-implement-administer-conditional-access.implement-session-management
-title: Implement session management
+title: Implement session management and continuous access evaluation
 metadata:
   adobe-target: true
   prefetch-feature-rollout: true
-  title: Implement session management
+  title: Implement session management and continuous access evaluation
   description: "Implement session management"
-  ms.date: 04/22/2025
+  ms.date: 06/27/2025
   author: wwlpublish
   ms.author: roberts
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/includes/11-implement-continuous-access-evaluation.md b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/includes/11-implement-continuous-access-evaluation.md
@@ -1,22 +1,136 @@
-Token expiration and refresh are a standard mechanism in the industry. When a client application like Outlook connects to a service like Exchange Online, the API requests are authorized using OAuth 2.0 access tokens. By default, access tokens are valid for one hour, when they expire the client is redirected to Microsoft Entra ID to refresh them. That refresh period provides an opportunity to reevaluate policies for user access. For example: we might choose not to refresh the token because of a Conditional Access policy, or because the user has been disabled in the directory.
+The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with Zero Trust and Microsoft learning.
 
-However, there is lag between when conditions change for a user, and when policy changes are enforced. Timely response to policy violations or security issues really requires a "conversation" between the token issuer, and the relying party (enlightened app). This two-way conversation gives us two important capabilities. The relying party can see when properties change, like network location, and tell the token issuer. It also gives the token issuer a way to tell the relying party to stop respecting tokens for a given user because of account compromise, disablement, or other concerns. The mechanism for this conversation is continuous access evaluation (CAE).
+The Conditional Access optimization agent evaluates policies such as requiring multifactor authentication (MFA). The agent enforces device based controls (device compliance, app protection policies, and domain-joined devices). Finally, the agent can help block legacy authentication and device code flow.
 
-### Benefits
+The agent also evaluates all existing enabled policies to propose potential consolidation of similar policies.
 
-There are several key benefits to continuous access evaluation.
+### Requirement to use the Conditional Access optimization agent
 
- - User termination or password change/reset: User session revocation will be enforced in near real time.
- - Network location change: Conditional Access location policies will be enforced in near real time.
- - Token export to a machine outside of a trusted network can be prevented with Conditional Access location policies.
+- You must have at least the **Microsoft Entra ID P1 license**.
+- You must have available **Security Compute Units (SCU)**.
+- To activate the agent the first time, you need the Security Administrator or higher role.
+- You can assign Conditional Access Administrators with Security Copilot access.
+  - For more information, see Assign Security Copilot access
+- Device-based controls require **Microsoft Intune licenses**.
 
-### Evaluation and revocation process flow
+### Conditional Access optimization agent key features
 
-:::image type="content" source="../media/user-revocation-event-flow.png" alt-text="Diagram of the process flow when an access token is revoked and a client has to reverify access.":::
+The Conditional Access optimization agent scans your tenant for new users and applications and determines if Conditional Access policies are applicable. The key features include:
 
-1. A continuous access evaluation (CAE)-capable client presents credentials or a refresh token to Microsoft Entra ID asking for an access token for some resource.
-2. An access token is returned along with other artifacts to the client.
-3. An Administrator explicitly revokes all refresh tokens for the user. A revocation event will be sent to the resource provider from Microsoft Entra ID.
-4. An access token is presented to the resource provider. The resource provider evaluates the validity of the token and checks whether there's any revocation event for the user. The resource provider uses this information to decide to grant access to the resource or not.
-5. In the case of the diagram, the resource provider denies access, and sends a 401+ claim challenge back to the client.
-6. The CAE-capable client understands the 401+ claim challenge. It bypasses the caches and goes back to step 1, sending its refresh token along with the claim challenge back to Microsoft Entra ID. Microsoft Entra ID will then reevaluate all the conditions and prompt the user to reauthenticate in this case.
+| Feature | Description |
+| :---  | :--- |
+| Require MFA | The agent identifies users who aren't covered by a Conditional Access policy that requires MFA and can update the policy. |
+| Require device-based controls | The agent can enforce device-based controls, such as device compliance, app protection policies, and domain-joined devices. |
+| Block legacy authentication | User accounts with legacy authentication are blocked from signing in. |
+| Policy consolidation | The agent scans your policy and identifies overlapping settings. For example, if you have more than one policy that has the same grant controls, the agent suggests consolidating those policies into one. |
+| Block device code flow | The agent looks for a policy blocking device code flow authentication. |
+| One-click remediation | When the agent identifies a suggestion, you can select Apply suggestion to have the agent update the associated policy with one press of a button. |
+
+## Give the Conditional Access optimization agent a try
+
+
+In this exercise, you explore key capabilities in the Security Copilot Conditional Access optimization agent embedded in Microsoft Entra.
+
+**As you explore, keep in mind that unless otherwise stated, the information displayed and the configuration settings are for the currently logged in Security Administrator**.
+
+> [!NOTE]
+> The environment for this exercise is a simulation generated from the product. As a limited simulation, not all links on a page are enabled and text-based inputs that fall outside of the specified script aren't supported. A pop-up stating, "This feature isn't available within the simulation" message displays. When you receive this message, select OK and continue the exercise steps.
+>
+>
+>:::image type="content" source="../media/simulation-pop-up-error.png" alt-text="Screenshot of pop-up screen indicating that this feature isn't available within the simulation.":::
+
+### Exercise
+
+This exercise should take approximately **10** minutes to complete.
+
+> [!NOTE]
+> When a lab instruction calls for opening a link to the simulated environment, it's recommended that you open the link in a new browser window so that you can simultaneously view the instructions and the exercise environment. To do so, select the right mouse key and select the option.
+
+1. Open [https://Entra.Microsoft.com (simulation)](https://app.highlights.guide/start/673ccf96-b6de-43aa-b267-5c8efe51639c?token=16d48b6c-eace-4a1f-8050-098d29d23a89&azure-portal=true) with at least the Security Administrator role.
+ 
+There are two ways to launch the Security Copilot Agents screen:
+
+   -	Option-1: Select the **Try Security Copilot** agents free for 60 days
+   -	Option-2: Open Conditional Access from the menu on the left.  Then select the Conditional Access Optimization agent.
+
+Please feel free to use either option to launch the agent, but remember that both options are available.
+
+### Option-1:
+1.	Select the "free 60 day trial" button.
+2.	Select **View Details** on the page:
+ 
+### Option-2:
+1.	Open the **Conditional Access** item in the left-side menu.
+2.	On the **Overview** tab, select **Conditional Access Optimization Agent**.
+ 
+### Exploring the Conditional Access Agent
+ 
+1.	Review the **Overview** tab.
+
+   - Agent is active – Note the last time the agent ran and the upcoming schedule.
+   - Performance highlights – Review the cost in Security Compute Units (SCUs) for the agent.  See how many unprotected users the agent found to protect.
+   - About this agent – Quick description of the agent and how it works.
+   - Recent suggestions – Review of all existing Conditional Access policies and suggestions on how they could be merged, updated, removed, or enhanced.
+   - Recent Activity – Status on the last few attempts of the Conditional Access Optimization Agent to run, and the results.
+
+2.	Select the **View run** link within the **Agent is active** box.
+
+3.	Review the process flow of the agent and see what new information was detected since the last completion.
+   - Take note that is search for three common access rights optimizations:
+      - App / Application drift – new applications were deployed and need to be protected.
+      - User drift – new users were found, or user rights changed that leave them unprotected by policy.
+      - Policy merge – places where 2 or more policies could be merged to provide the same result, with easier management.
+
+4.	Select the breadcrumb **Conditional Access Optimization Agent** to return to the Overview page.
+
+5.	Select the Activities tab in the top menu.  Review the history of when the Conditional Access Optimization agent ran and the results.
+
+6.	Select several different **View activity** buttons to see the progression of the Conditional Access Optimization agent as it runs each 24-hour period.
+
+7.	Open the second item on the list.  Notice, four new applications were found, and recommended policy changes over time.
+
+8.	Use the breadcrumbs to return to the Overview page.
+
+9.	Select the **Suggestions** from the tab menu.
+
+10.	Explore the suggestion history.  You have one item for each day the agent ran.
+
+11.	Select the **Review suggestion** button for the first item.
+
+12.	Notice, the policy wants to add 2 users to an existing Conditional Access policy. The goal is to add users to CA99 – Mitigate Risk Users with Password Reset policy.
+
+13.	Select the **Policy impact** tab at the top of the page to see a graph of this policy change over time.
+
+14.	Switch back to the **Policy details** tab, then select the **Review policy changes** to see the proposed changes and the JSON update to be made.
+
+15.	Use the browser **Back** button to return to the **Overview** page.
+
+16.	Select **Suggestions** from the menu.
+
+17.	Select the **X** in the upper right of the screen to close the dialog.
+
+### Explore Conditional Access Optimization Agents in CA-Policies 
+
+1.	Open Conditional Access from the menu on the left.
+
+2.	Select **Policies** from the Conditional Access menu.
+
+3.	Review the list of policies, you should see three types:
+
+   - Microsoft – global policies sent out by Microsoft, like require MFA.
+   - User – conditional access policies created by an authorized user in your organization.
+   - Conditional Access Optimization Agent – Report Only policies created by the agent for your review.  You can choose to apply them depending on business and security goals.
+
+4.	Scroll down the list to find the CA99 policy we reviewed earlier.
+ 
+5.	Select the **New agent suggestion** item.
+
+6.	On four occasions the Conditional Access Optimization agent found new user, and has an **Apply suggestion** for each.
+
+7.	Read over the description of what the suggestion is going to do.
+
+8.	Select the **Apply suggestion** button.
+
+**Result** – The agent, monitors your users each day and found users that weren't protected by Risky User policies.  It suggested you update your policy to include the new users, and provided you with a button to make the change.  In one button you added protection for the users.
+
+9.	Exit Microsoft Entra to finish the simulation.
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/includes/12-knowledge-check.md b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/includes/12-knowledge-check.md
@@ -1,2 +1,3 @@
 
+
 Choose the best response for each of the questions below.
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/includes/9-implement-session-management.md b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/includes/9-implement-session-management.md
@@ -67,3 +67,29 @@ Use the What-If tool to simulate a sign-in from the user to the target applicati
 ## Policy deployment
 
 To make sure that your policy works as expected, the recommended best practice is to test it before rolling it out into production. Ideally, use a test tenant to verify whether your new policy works as intended.
+
+## Continuous Access Evaluation (CAE)
+
+Token expiration and refresh are a standard mechanism in the industry. When a client application like Outlook connects to a service like Exchange Online, the API requests are authorized using OAuth 2.0 access tokens. By default, access tokens are valid for one hour, when they expire the client is redirected to Microsoft Entra ID to refresh them. That refresh period provides an opportunity to reevaluate policies for user access. For example: we might choose not to refresh the token because of a Conditional Access policy, or because the user has been disabled in the directory.
+
+However, there is lag between when conditions change for a user, and when policy changes are enforced. Timely response to policy violations or security issues really requires a "conversation" between the token issuer, and the relying party (enlightened app). This two-way conversation gives us two important capabilities. The relying party can see when properties change, like network location, and tell the token issuer. It also gives the token issuer a way to tell the relying party to stop respecting tokens for a given user because of account compromise, disablement, or other concerns. The mechanism for this conversation is continuous access evaluation (CAE).
+
+### Benefits
+
+There are several key benefits to continuous access evaluation.
+
+ - User termination or password change/reset: User session revocation will be enforced in near real time.
+ - Network location change: Conditional Access location policies will be enforced in near real time.
+ - Token export to a machine outside of a trusted network can be prevented with Conditional Access location policies.
+
+### Evaluation and revocation process flow
+
+:::image type="content" source="../media/user-revocation-event-flow.png" alt-text="Diagram of the process flow when an access token is revoked and a client has to reverify access.":::
+
+1. A continuous access evaluation (CAE)-capable client presents credentials or a refresh token to Microsoft Entra ID asking for an access token for some resource.
+2. An access token is returned along with other artifacts to the client.
+3. An Administrator explicitly revokes all refresh tokens for the user. A revocation event will be sent to the resource provider from Microsoft Entra ID.
+4. An access token is presented to the resource provider. The resource provider evaluates the validity of the token and checks whether there's any revocation event for the user. The resource provider uses this information to decide to grant access to the resource or not.
+5. In the case of the diagram, the resource provider denies access, and sends a 401+ claim challenge back to the client.
+6. The CAE-capable client understands the 401+ claim challenge. It bypasses the caches and goes back to step 1, sending its refresh token along with the claim challenge back to Microsoft Entra ID. Microsoft Entra ID will then reevaluate all the conditions and prompt the user to reauthenticate in this case.
+
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/index.yml b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/index.yml
diff --git a/learn-pr/wwl-sci/plan-implement-administer-conditional-access/media/simulation-pop-up-error.png b/learn-pr/wwl-sci/plan-implement-administer-conditional-access/media/simulation-pop-up-error.png
