Conditional Access Policies

Azure AD Conditional Access is a feature in Azure Active Directory that allows administrators to set policies that determine how and when users can access cloud resources. Microsoft has simplified Conditional access configuration by providing pre-designed templates that can be easily customized to meet the specific needs of an organization. These templates are designed to provide a more convenient method of deploying new policies based on Microsoft’s recommendations and best practices. When used correctly, templates reduce the risk of misconfigurations, improve security, and make configuration and management less complex especially for companies new to cloud computing.

There are 14 Conditional Access policy templates available filtered by five different scenarios

1. Secure foundation 
2. Zero Trust 
3. Remote work 
4. Protect administrators 
5. Emerging threats 
6. All 

How to Use Azure AD Conditional Access Templates?

You can access the templates in the Azure portal via Azure Active Directory, then click on Security, Select Conditional Access, then click on New policy from template (Preview), To view all policy templates.

The “New policy from template (Preview)” feature in Azure AD Conditional Access allows admins to quickly create policies that enforce specific security controls for their organization. The templates are designed to be flexible and can be customize to fit the unique requirements of most organizations. For example, you can adjust the settings for user and group assignments, cloud apps, session controls, and more or apply additional controls, such as MFA or Azure AD Identity Protection, to the policy.

It’s important to note that the “New policy from template (Preview)” feature is still in preview, which means that it may be subject to change or may not be available in certain regions. Additionally, before applying any policies created from templates to production, you should thoroughly test them and ensure that they meet your organization’s requirements.

Select the scenario that you want to create the policy for

When creating an Azure AD Conditional Access policy, you need to select the scenario that you want to create the policy for.

A scenario is a pre-defined security use case, and with Microsoft’s predefined templates, users have six options to choose from. You can configure policies based on Zero trust, Secure foundation, Remote work, Protect administrator, Emerging threats, or choose all the mentioned categories. By selecting a scenario, you will be presented with a list of policy templates that are appropriate for that scenario, helping you quickly find the right template to use. The template chosen will determine the policy settings that will be available to further configure. Ensure that the scenario chosen aligns with your organization’s security needs and goals.

Select the template that you want to use

Once you have selected the appropriate scenario and template for your Conditional access policy, you can then customize the policy settings as needed. Customizing the policy settings will help you to create a more robust and effective policy that aligns with the specific security needs of your organization. The policy settings that can be customized include:

• User and group assignments: You can specify which users or groups the policy will apply to.
• Cloud apps: You can specify which cloud apps the policy will apply to.
• Session controls: You can configure settings such as session timeouts and sign-in frequency.
• Additional controls: You can add additional controls such as MFA or Azure AD Identity Protection.

It’s important to thoroughly review the policy settings and make any necessary adjustments. This will ensure that the policy is properly configured and meets the specific needs of your organization. Additionally, you should test the policy in a non-production environment (report only mode) before applying it to production to make sure it works as expected.

Create policy on report only mode .

After customizing, create the policy in “report only” and apply it to the specified users and resources. The ‘Report-only’ mode in Conditional Access policies will allow you to evaluate the impact of the policies before enabling them in your environment.”

It’s important to note that the policy will not take effect immediately. There may be a delay before the policy is fully enforced. Once the policy is created, you can view and manage it by going to the Azure portal > Azure Active Directory > Security > Conditional Access. From here, you can view the policy details, make changes to the settings, or delete the policy if it’s no longer needed. Additionally, you can check the audit logs for the a policy to see how it’s being used and to troubleshoot any issues that may arise.

It’s important to regularly review and update your Conditional Access policies as your organization’s security needs and requirements evolve. Security needs can change due to a variety of factors such as changes in the organization’s structure, implementing new technologies, or even shifts in the threat landscape. As a result, it is important for organizations to regularly review polices to ensure that they are effectively protecting their resources. This can involve reviewing and updating the conditions under which access is granted, e.g devices and locations that are allowed to access company resources, as well as the level of authentication required at any particular time.