sysop@hub:~/explainers/conditional-access-explained$

conditional-access-explained

How Conditional Access decides

What happens between entering a password and getting a token when Conditional Access policies are in place.

Read the steps as text

Sign in. The user provides the first factor, usually a password.
Risk check. Entra ID asks Identity Protection how risky this sign-in and this user are. This needs Entra ID P2.
Risk level. The answer is a risk level such as low, medium or high, based on signals like unfamiliar locations or leaked credentials.
Device check. For policies that need a managed device, Entra ID checks the device state with Intune.
Compliance state. Intune reports whether the device is compliant.
Evaluate policies. Entra ID passes all signals to Conditional Access: user or group, app, location, device platform and state, client app and risk.
Decision. All matching policies are combined. The result is block, or grant with requirements such as MFA or a compliant device. A block ends with the error AADSTS53003.
MFA, then tokens. The user completes what is required and Entra ID issues the tokens. If the result was a block, the user sees an error instead.

Use report-only mode to test a new policy before enforcing it, and check the sign-in logs to see which policy applied.
All matching policies apply together, and a block always wins over a grant.
Keep emergency access accounts out of the policies, but monitor them.