Old access models are obsolete. Once authenticated, always trusted? Dangerous. Conditional Access changes the game: every access is evaluated, context is key. This article follows on from our guide to Entra ID migration for public authorities and shows how to design the policies that make Zero Trust real.
Rethinking Access Control
For the public sector this is a step change. Security becomes dynamic, user-friendliness is maintained, and a cloud-first administration becomes defensible in front of auditors.
What Conditional Access Does
Conditional Access is a policy framework that evaluates access in real time. Who? From where? With what device? To what? These questions are answered on every sign-in.
Based on the answers, decisions are made: allow access, block access, require MFA, or restrict the session.
Understanding the Signals
User and Group — Who is accessing? Administrators have different rules than standard users. Externals different from internals.
Location — Where is the access coming from? Known networks are more trustworthy. Unknown countries are blocked.
Device — Is the device managed? Is it compliant? Unknown devices require additional verification.
Application — Which app is being accessed? Sensitive applications need stronger protection.
Risk — Entra ID automatically assesses sign-in and user risk. Unusual behaviour is detected. Compromised accounts are locked.
Quick Checklist: Conditional Access Policies
| Policy | Goal | Action |
| MFA for Admins | Protect privileged accounts | Enforce MFA |
| Blocked Countries | Stop attacks from high-risk regions | Block access |
| Compliant Devices | Allow only secure devices | Require compliance |
| Block Legacy Auth | Prevent insecure protocols | Block |
| Session Timeout | Reduce risk during inactivity | Limit session |
| App Protection | Protect sensitive apps | Require MFA + Compliance |
To-Do List for Conditional Access
- Day 1: Activate report-only mode.
- Week 1: Define baseline policies.
- Week 2: Enforce MFA for all admins.
- Week 3: Block legacy authentication.
- Month 1: Introduce device compliance.
- Month 2: Implement location-based policies.
- Month 3: Implement risk-based policies.
Comparing MFA Methods
Not all MFA methods are equal. Some are more secure, others more user-friendly. The right choice depends on the context.
Microsoft Authenticator — Push notifications are simple. Number matching increases security. Passwordless login is possible.
FIDO2 Security Keys / Passkeys — Hardware-based and phishing-resistant. Ideal for high-security environments and administrators. Slightly higher cost.
SMS and Phone — Easy to implement, but less secure. Recommended only as a fallback.
Windows Hello for Business — On-device biometrics. Very user-friendly. Requires compatible hardware.
Meeting Compliance Requirements
BSI C5 demands strong authentication; Conditional Access delivers it. ISO 27001 based on IT-Grundschutz requires documented access control; Conditional Access logs every decision. NIS2 recommends Zero Trust; Conditional Access is a core component and supports the Data Protection Impact Assessment for cloud services.
Integration with Other Services
Conditional Access does not stand alone. It integrates with Microsoft Defender, uses Intune for device compliance, and connects to a SIEM (e.g., Microsoft Sentinel) for monitoring. A well-designed Azure Landing Zone includes the Conditional Access baseline from day one, and managed services keep the policies monitored.
Insight42 Conditional Access Services
We design Conditional Access strategies tailored for public authorities — compliant with BSI C5 and IT-Grundschutz, and user-friendly. From analysis to implementation and managed operations.
Control access intelligently. See NIS2 & Cloud Security Beratung (German) or contact us.