<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-conditional-access-policies
description: >-
  Design, implement, and audit Conditional Access policies for Azure AD/Entra ID
  including risk-based access controls, device compliance, location restrictions,
  session management, and policy conflict resolution.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - conditional-access
  - azure-ad
  - entra-id
  - zero-trust
  - risk-based-access
  - device-compliance
  - session-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Implementing Conditional Access Policies

## Overview

Conditional Access is the zero trust policy engine for Azure AD/Entra ID, evaluating
signals (user, device, location, risk) to enforce access decisions. Common misconfigurations
include incomplete user coverage, missing legacy auth blocks, overly permissive
named locations, and policy conflicts that create bypass paths. This skill designs
defense-in-depth policies and audits existing configurations.

Mode: `[MODE: ARCHITECT]` for policy design; `[MODE: BLUE]` for auditing; `[MODE: RED]` for bypass testing.

MITRE ATT&CK: T1556.006 (Modify Authentication Process: Conditional Access Policies)

## Prerequisites

- Azure AD Premium P1/P2 license
- Global Administrator or Conditional Access Administrator role
- Microsoft Graph API access
- Python 3.10+ with `azure-identity`, `msgraph-sdk`

## Key Concepts

### Critical Policy Set

| Policy | Purpose | Priority |
|--------|---------|----------|
| Block legacy authentication | Eliminate IMAP/POP3/SMTP bypass | P0 |
| Require MFA for all users | Universal strong authentication | P0 |
| Require compliant device | Managed device enforcement | P1 |
| Block high-risk sign-ins | Identity Protection integration | P1 |
| Restrict by location | Block untrusted geographies | P2 |
| Session lifetime limits | Reduce token theft window | P2 |
| Require password change on risk | Auto-remediate compromised users | P1 |

### Policy Evaluation Order

```
1. Block policies evaluated first — any match = access denied
2. Grant policies evaluated — ALL required controls must be met
3. Session policies applied — controls on granted sessions
4. Report-only policies — logged but not enforced

Conflicts: Block overrides Grant. Multiple Grant policies = intersection (AND).
```

### Bypass Vectors

```
├── Legacy Protocol Bypass
│   └── IMAP/POP3/SMTP if legacy auth not blocked
├── Named Location Abuse
│   └── VPN to trusted location to bypass geo-restriction
├── Device Compliance Gap
│   └── BYOD devices not enrolled in MDM
├── App Exclusion
│   └── Critical apps not covered by policy
├── User Exclusion
│   └── Break-glass accounts or service principals excluded
├── Conditional Access Gap
│   └── Policy only targets "Browser" — misses mobile apps
└── Token Theft
    └── Session token stolen post-CA evaluation
```

## Workflow

### Step 1: Audit Existing Policies

```bash
# Export all Conditional Access policies
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
  --output-file /tmp/ca_policies.json

# Analyze for gaps
node scripts/agent.js --input /tmp/ca_policies.json --output /tmp/ca_findings.json
```

### Step 2: Deploy Critical Policies

```bash
# Block legacy authentication
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
  --body '{
    "displayName": "CA001: Block Legacy Authentication",
    "state": "enabledForReportingButNotEnforced",
    "conditions": {
      "users": {"includeUsers": ["All"], "excludeUsers": ["BREAK_GLASS_ID"]},
      "applications": {"includeApplications": ["All"]},
      "clientAppTypes": ["exchangeActiveSync", "other"]
    },
    "grantControls": {"operator": "OR", "builtInControls": ["block"]}
  }'

# Require MFA for all users
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
  --body '{
    "displayName": "CA002: Require MFA All Users",
    "state": "enabledForReportingButNotEnforced",
    "conditions": {
      "users": {"includeUsers": ["All"], "excludeUsers": ["BREAK_GLASS_ID"]},
      "applications": {"includeApplications": ["All"]},
      "clientAppTypes": ["all"]
    },
    "grantControls": {"operator": "OR", "builtInControls": ["mfa"]}
  }'
```

### Step 3: Validate in Report-Only Mode

```bash
# Check report-only results
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=conditionalAccessStatus eq 'reportOnlyNotApplied'&\$top=50"
```

### Step 4: Enable Enforcement

```bash
# Move from report-only to enabled after validation
node scripts/agent.js --input /tmp/ca_policies.json --enable-policy "CA001"
```

## Detection

```yaml
title: Conditional Access Policies Detection
id: e15f61cd-441e-42b6-99bb-ddeebfad072b
status: experimental
description: Detects suspicious activity related to implementing conditional access policies techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] Legacy authentication blocked for all users (no exceptions)
- [ ] MFA required for all users and all apps
- [ ] Break-glass accounts excluded but monitored with alerts
- [ ] Compliant device required for sensitive applications
- [ ] High-risk sign-ins blocked or require password change
- [ ] Named locations use IP ranges (not country-level)
- [ ] All client app types covered (browser + mobile + desktop)
- [ ] Policy tested in report-only before enforcement
- [ ] No policy conflicts creating unintended bypass paths

## References

- [Microsoft — Conditional Access Policies](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview)
- [Microsoft — Common Conditional Access Policies](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-common)
- [CIS Microsoft 365 Foundations Benchmark](https://www.cisecurity.org/benchmark/microsoft_365)
- [NIST SP 800-207 — Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
