Conditional Access Policy Evaluation Flow

Conditional Access in Azure AD uses signals like user role, location, and risk level to enforce access policies. Integrating MFA into Conditional Access ensures that only trusted users and devices can access Azure resources, even if their passwords are compromised. To embed MFA, an admin defines a policy with three parts. Under Assignments, include all users or specific roles and exclude break-glass accounts that need emergency access. Under Conditions, set Sign-in risk or User risk to trigger the policy on Medium or High risk levels. Under Access controls, select Grant and then Require multi-factor authentication. Under Session, configure Sign-in frequency to enforce reauthentication after a specified time period.