Edit

Create a Microsoft Entra Conditional Access policy plan (preview)

This article shows you how to create a Conditional Access policy plan in the Microsoft Entra admin center, either from a built-in template or from scratch. For background on how plans work and why to use them, see What are Conditional Access policy plans?.

Before you create a plan, identify its security objective. For example, a plan might protect employees at a specific location, secure agent activity, or require compliant devices. Add only the assignments and conditions that apply to every scenario to the plan's shared conditions. Configure variations of the objective as individual rules.

Important

Conditional Access policy plans are in preview. Preview features are available under the Supplemental Terms of Use for Microsoft Azure Previews and might not have all the capabilities of generally available features.

Prerequisites

To create, modify, or delete a policy plan, sign in with the Conditional Access Administrator role.

For license requirements, see Conditional Access license requirements.

Before you begin, read What are Conditional Access policy plans? to understand how shared conditions and rules interact.

User exclusions

Conditional Access policies are powerful tools. We recommend excluding the following accounts from your policies:

  • Emergency access accounts to prevent lockout because of policy misconfiguration. In the unlikely scenario where all administrators are locked out, your emergency access administrative account can be used to sign in and recover access. For more information, see Manage emergency access accounts in Microsoft Entra ID.
  • Service accounts and service principals, such as the Microsoft Entra Connect Sync Account. Service accounts are noninteractive accounts that aren't tied to a specific user. They're typically used by back-end services to allow programmatic access to applications. Calls made by service principals aren't blocked by Conditional Access policies scoped to users. Use Conditional Access for workload identities to define policies that target service principals.

Tip

With policy plans, add emergency access accounts and service accounts to the plan's shared conditions exclusion list instead of repeating them in each rule. Exclusions set at the plan level apply to every rule automatically and can't be removed by an individual rule.

Create a policy plan from a template

Templates provide preconfigured shared conditions and rules for common Conditional Access scenarios, including plans that secure agent activity. Starting from a template creates the plan, shared conditions, and one or more rules in a single flow.

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policy plans (Preview).
  3. Select Create policy from template.
  4. Browse the available templates, select Use template for one or more templates, and then select Create plan.
  5. On the Create plan from templates tab, customize the name if needed. Under Shared conditions, review any prepopulated targeting, and then select Create policy plan. The initial State for all rules generated by a template is Off to prevent unintended impact to your organization.
  6. After the plan is created, select Edit plan. Select Add Users > Exclude to add your organization's emergency access accounts and any service accounts that must be excluded from every rule in the plan. Modify any other shared conditions as needed.
  7. In the Rules list, review the prepopulated rules. Select a rule to edit its name, conditions, or grant controls. Each rule is evaluated independently at sign-in time.
  8. For each rule, change State from Off to Report-only. Report-only mode lets you validate the effect in sign-in logs before enforcement begins.

After you review the effect by using report-only mode, return to each rule, set State to On, and save your changes.

Create a custom policy plan

Build a plan from scratch when your scenario isn't covered by a template, or when you want full control over shared conditions and rules from the start.

Create the plan

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policy plans (Preview), and then select Create policy.
  3. On the Create policy plan tab, enter a name. Optionally, add a description and tags. Your account is automatically added as an owner. Add other individual or group owners as needed to record accountability. The owner field is for accountability only and doesn't grant permissions to policy plans.

Configure shared conditions

Shared conditions are optional and apply to every rule in the plan.

Note

Add only assignments and conditions that apply to every rule to shared conditions. Configure anything that varies by scenario in the individual rules. You can add exclusions at the rule level, but you can't remove or override exclusions set in shared conditions. Identity type must be consistent. A plan that targets users at the plan level can't also target workload identities at the plan level.

  1. Under Add users, agents or workload identities, select the identities to include or exclude that every rule in the plan should target. All users isn't available at the plan level. Exclude emergency access accounts and service accounts in shared conditions so the exclusions propagate to every rule.
  2. Under Add resources, user actions or authentication context, optionally scope the plan to include or exclude a shared set of applications, actions, or contexts.
  3. Under Add condition, optionally configure shared risk levels, device platforms, network locations, or client app types that should apply across all rules.
  4. Select Continue to add your first rule.

Add rules to the plan

Every plan must have at least one rule. Each rule inherits the plan's shared assignments and conditions, so you don't need to configure them again. The rule adds the assignments, conditions, and controls that are specific to its scenario.

  1. Enter a name and optional description for the rule.
  2. Under State, select Report-only.
  3. Under Add users, agents or workload identities, select the identities to include or exclude.
  4. Under Add resources, user actions or authentication context, scope the rule to include or exclude applications, actions, or contexts. Select All resources here when the rule should protect every resource.
  5. Under Add condition, include conditions that should apply, or exclude specific device platforms, networks, or locations. These conditions combine with the plan's shared conditions at evaluation time.
  6. Under Add control > Grant, select the grant controls to enforce when the rule matches.
  7. Under Add control > Session, optionally configure session controls.
  8. Review the plan and its initial rule, and then select Create.
  9. Repeat these steps for each additional scenario. Each rule appears as an independent entry in sign-in logs.

After you review the impact with the built-in policy impact metrics or in sign-in logs by using report-only mode, return to each rule, set State to On, and save your changes.

Next steps

  • Last updated on