{"items":[{"href":"./","toc_title":"Conditional Access Documentation"},{"children":[{"href":"overview","toc_title":"What is Conditional Access?"}],"toc_title":"Overview"},{"children":[{"href":"agent-optimization","toc_title":"Get started with the Conditional Access optimization agent"},{"href":"agent-optimization-review-suggestions","toc_title":"Review and approve suggestions"},{"href":"agent-optimization-chat","toc_title":"Chat with the optimization agent"},{"href":"agent-optimization-logs-metrics","toc_title":"Optimization agent logs and metrics"},{"href":"agent-optimization-phased-rollout","toc_title":"Phased rollout"}],"toc_title":"Security Copilot \u002B Microsoft Entra"},{"children":[{"href":"../authentication/tutorial-enable-azure-mfa?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"Require multifactor authentication"}],"toc_title":"Tutorials"},{"children":[{"href":"concept-conditional-access-policy-common","toc_title":"Conditional Access templates"},{"href":"concept-conditional-access-policies","toc_title":"Conditional Access policy components"},{"href":"agent-id","toc_title":"Conditional Access for agents"},{"children":[{"href":"concept-conditional-access-users-groups","toc_title":"Users, groups, and roles"},{"href":"concept-conditional-access-cloud-apps","toc_title":"Target resources"},{"href":"concept-enforcement-resource-exclusions","toc_title":"Enforcement for baseline scopes"},{"href":"concept-assignment-network","toc_title":"Network"},{"href":"concept-conditional-access-conditions","toc_title":"Conditions"}],"toc_title":"Assignments"},{"children":[{"href":"concept-conditional-access-grant","toc_title":"Grant"},{"href":"concept-conditional-access-session","toc_title":"Session"}],"toc_title":"Access controls"},{"href":"concept-conditional-access-report-only","toc_title":"Analyze impact"},{"href":"service-dependencies","toc_title":"Service dependencies"},{"href":"concept-filter-for-applications","toc_title":"Filter for applications"},{"children":[{"href":"concept-token-protection","toc_title":"Token protection overview"},{"href":"deployment-guide-token-protection-windows","toc_title":"Deploy token protection for Windows"},{"href":"deployment-guide-token-protection-apple","toc_title":"Deploy token protection for Apple platforms"},{"href":"deployment-guide-token-protection-web-apps","toc_title":"Deploy token protection for web apps (Preview)"}],"toc_title":"Token protection"},{"href":"concept-authentication-flows","toc_title":"Authentication flows"},{"href":"resilience-defaults","toc_title":"Resilience defaults"},{"href":"concept-authentication-transfer","toc_title":"Authentication transfer"},{"href":"workload-identity","toc_title":"Workload identities"},{"children":[{"href":"concept-continuous-access-evaluation","toc_title":"CAE for users"},{"href":"concept-continuous-access-evaluation-strict-enforcement","toc_title":"CAE strict enforcement"},{"href":"concept-continuous-access-evaluation-workload","toc_title":"CAE for workload identities"}],"toc_title":"Continuous access evaluation"},{"href":"concept-session-lifetime","toc_title":"Adaptive session lifetimes"},{"href":"concept-condition-filters-for-devices","toc_title":"Filter for devices"},{"href":"what-if-tool","toc_title":"What if tool"},{"href":"../role-based-access-control/protected-actions-add?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"Protected actions"}],"toc_title":"Concepts"},{"children":[{"href":"plan-conditional-access","toc_title":"Plan your Conditional Access deployment"},{"href":"howto-target-agent-identities","toc_title":"Build policies for agents"},{"children":[{"href":"policy-autonomous-agents","toc_title":"Secure autonomous agents"},{"href":"policy-agent-user","toc_title":"Secure agents that act as users"}],"toc_title":"Secure agents"},{"children":[{"href":"policy-block-legacy-authentication","toc_title":"Block legacy authentication"},{"href":"policy-admin-phish-resistant-mfa","toc_title":"Require phishing-resistant MFA for administrators"},{"href":"policy-all-users-mfa-strength","toc_title":"Require MFA authentication strength for all users"},{"href":"policy-guests-mfa-strength","toc_title":"Require MFA authentication strength for guests"},{"href":"policy-all-users-security-info-registration","toc_title":"Secure security info registration"},{"href":"policy-risk-based-sign-in","toc_title":"Require MFA for risky sign-in"},{"href":"policy-risk-based-user","toc_title":"Require remediation for risky users"},{"href":"policy-all-users-device-registration","toc_title":"Require authentication strength for device registration"},{"href":"policy-all-users-device-compliance","toc_title":"Require device compliance"},{"href":"policy-block-authentication-flows","toc_title":"Restrict device code flow and authentication transfer"}],"toc_title":"Recommended policies"},{"children":[{"children":[{"href":"policy-all-users-approved-app-or-app-protection","toc_title":"Require approved app or app protection policy"},{"href":"policy-all-users-windows-app-protection","toc_title":"Require app protection policy for Windows"},{"href":"policy-all-users-app-enforced-restrictions","toc_title":"Use application enforced restrictions"}],"toc_title":"Applications"},{"children":[{"href":"policy-all-users-device-unknown-unsupported","toc_title":"Block access for unknown or unsupported devices"},{"href":"policy-alt-admin-device-compliand-hybrid","toc_title":"Require compliant or hybrid join for admins"},{"href":"policy-alt-all-users-compliant-hybrid-or-mfa","toc_title":"Require compliant device, hybrid joined, or MFA"},{"href":"policy-all-users-persistent-browser","toc_title":"No persistent browser session"},{"href":"/mem/intune/enrollment/multi-factor-authentication?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"Require MFA for Intune enrollment"},{"href":"policy-teams-devices-device-code-flow","toc_title":"Restrict device code flow for Teams devices"}],"toc_title":"Devices"},{"children":[{"href":"policy-old-require-mfa-admin","toc_title":"Require MFA for administrators"},{"href":"policy-old-require-mfa-guest","toc_title":"Require MFA for guest users"},{"href":"policy-old-require-mfa-admin-portals","toc_title":"Require MFA for Microsoft admin portals"},{"href":"policy-old-require-mfa-azure-mgmt","toc_title":"Require MFA for Azure management"}],"toc_title":"Multifactor authentication"},{"href":"policy-risk-based-insider-block","toc_title":"Block users with elevated insider risk"},{"href":"policy-all-users-require-terms-of-use","toc_title":"Require terms of use to be accepted"},{"href":"policy-block-by-location","toc_title":"Block access by location"},{"href":"policy-block-example","toc_title":"Block access"}],"toc_title":"Other policy examples"},{"href":"managed-policies","toc_title":"Microsoft-managed policies"},{"href":"howto-conditional-access-insights-reporting","toc_title":"Policy insights and reporting"},{"href":"terms-of-use","toc_title":"Require terms of use"},{"href":"howto-conditional-access-session-lifetime","toc_title":"Sign-in frequency and browser persistence control"},{"href":"deployment-guide-token-protection-windows","toc_title":"Deploy Token Protection for Windows"},{"href":"deployment-guide-token-protection-apple","toc_title":"Deploy Token Protection for Apple platforms"},{"href":"deployment-guide-token-protection-web-apps","toc_title":"Deploy Token Protection for web apps (Preview)"},{"children":[{"href":"troubleshoot-policy-changes-audit-log","toc_title":"Troubleshoot policy changes"},{"href":"troubleshoot-conditional-access","toc_title":"Troubleshoot sign-in problems"},{"href":"troubleshoot-security-copilot-policies","toc_title":"Troubleshoot Security Copilot"},{"href":"howto-continuous-access-evaluation-troubleshoot","toc_title":"Troubleshoot continuous access evaluation"}],"toc_title":"Troubleshooting"},{"href":"migrate-approved-client-app","toc_title":"Approved client app migration"}],"expanded":true,"toc_title":"How-to guides"},{"children":[{"href":"reference-office-365-application-contents","toc_title":"Office 365 application"},{"children":[{"href":"/graph/api/resources/conditionalaccesspolicy?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"conditionalAccessPolicy"},{"href":"/graph/api/resources/namedlocation?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"namedLocation"},{"href":"/graph/api/resources/countrynamedlocation?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"countryNamedLocation"},{"href":"/graph/api/resources/ipnamedlocation?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"ipNamedLocation"},{"href":"/graph/api/resources/conditionalaccesstemplate?toc=/entra/identity/conditional-access/toc.json\u0026bc=/entra/identity/conditional-access/breadcrumb/toc.json","toc_title":"conditionalAccessTemplate"}],"toc_title":"Microsoft Graph APIs"},{"href":"controls","toc_title":"Custom controls"},{"href":"how-to-migrate-custom-controls-external-mfa","toc_title":"Migrate custom controls to external MFA"}],"toc_title":"Reference"},{"children":[{"href":"https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789","toc_title":"Azure feedback forum"},{"href":"/answers/topics/azure-active-directory.html","toc_title":"Microsoft Q\u0026A question page"},{"href":"https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing","toc_title":"Pricing"},{"href":"../../fundamentals/whats-new","toc_title":"Service updates"},{"href":"https://stackoverflow.com/questions/tagged/azure-active-directory","toc_title":"Stack Overflow"}],"toc_title":"Resources"}],"metadata":{"author":"kenwith","brand":"entra","breadcrumb_path":"/entra/breadcrumb/toc.json","count_of_node_with_href":92,"extendBreadcrumb":false,"feedback_github_repo":"MicrosoftDocs/entra-docs","feedback_product_url":"https://feedback.azure.com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4","feedback_system":"Standard","manager":"dougeby","ms.author":"kenwith","ms.service":"entra-id","ms.subservice":"conditional-access","open_to_public_contributors":true,"searchScope":["Microsoft Entra"],"titleSuffix":"Microsoft Entra ID","uhfHeaderId":"MSDocsHeader-Entra"}}