2.2MS-102Advanced

Est: ~15 mins•Verified: 2026-08

Conditional Access: Zero Trust & Phishing-Resistant MFA

Architect, test, and deploy Microsoft Entra Conditional Access policies enforcing Zero Trust, phishing-resistant MFA (FIDO2), compliant devices, and session controls.

Tags:#Conditional Access#Zero Trust#MFA#FIDO2#Entra ID#MS-102

Overview

Microsoft Entra Conditional Access is the intelligent policy engine at the core of Microsoft's Zero Trust architecture ("Never Trust, Always Verify"). It analyzes real-time contextual signals from identity, device, location, and application to make automated policy decisions: Allow, Block, or Grant with Requirements.

Key enterprise capabilities include:

Phishing-Resistant Authentication Strengths: Enforcing cryptographic hardware keys (FIDO2 / passkeys) and Windows Hello for Business, blocking legacy SMS/voice and prompt-bombing attacks.
Device Compliance Gate: Requiring Intune-managed compliant devices before granting access to corporate data.
Risk-Based Signals: Dynamically challenging sign-ins flagged by Entra Identity Protection.
Session Controls: Enforcing Continuous Access Evaluation (CAE) and Cloud App Security proxy monitoring.

---

When to Use: Core Policy Matrix

Policy Objective	Target Scope	Conditions	Grant Control
Require Phishing-Resistant MFA for Admins	All Directory Roles	All Cloud Apps	Grant: Require authentication strength (Phishing-resistant).
Require Compliant Device for All Users	All Users (Exclude break-glass)	Windows, macOS, iOS, Android	Grant: Require device to be marked as compliant.
Block Legacy Authentication	All Users	Client apps: Exchange ActiveSync, Other clients	Block Access.
Emergency Break-Glass Exclusion	Break-glass Security Group	Excluded from ALL policies	N/A (Guarantees tenant access).

---

Prerequisites

Licensing:

Microsoft Entra ID P1 (for standard Conditional Access).
Microsoft Entra ID P2 (for risk-based Conditional Access policies).
Microsoft 365 E3/E5, Business Premium, or standalone Entra P1/P2.

Administrative Roles:

Conditional Access Administrator or Security Administrator.

---

Portal Path

TEXT

Microsoft Entra Admin Center (https://entra.microsoft.com)
└── Protection
    └── Conditional Access
        ├── Policies (Create, edit, manage state: On / Off / Report-only)
        ├── Named locations (Configure trusted IP ranges & countries)
        ├── Authentication strengths (FIDO2, Passwordless, Phishing-resistant)
        └── What If (Simulate policy evaluation for users & devices)

---

Step-by-Step Implementation

Step 1: Create Trusted Named Locations

Go to Entra Admin Center > Protection > Conditional Access > Named locations.
Click IP ranges location > Name: HQ-Corporate-Egress-IPs.
Enter public CIDR ranges (e.g., 198.51.100.0/24) > Check Mark as trusted location > Save.

Step 2: Build the Admin Phishing-Resistant MFA Policy

In Conditional Access > Policies > Click New policy.
Name: CA-Admin-RequirePhishingResistantMFA.
Users:

Include: Under Directory roles, select Global Administrator, Privileged Role Admin, Exchange Admin, Security Admin, Intune Admin (14 high-privilege roles).
Exclude: Select your Emergency-BreakGlass-Accounts security group.

Target resources: All cloud apps.
Grant:

Select Grant access > Check Require authentication strength.
Choose: Phishing-resistant MFA (FIDO2 security keys, Windows Hello for Business).

Enable policy: Set to Report-only for 7 days to review sign-in logs before setting to On.

Step 3: Test Using the "What If" Tool

In Conditional Access, click What If in the top menu.
Select a target administrator user.
Select Cloud app: Microsoft Azure Management.
Click What If.
Inspect the bottom panel to verify that CA-Admin-RequirePhishingResistantMFA evaluates under Policies that will apply.

---

PowerShell Automation

Audit All Conditional Access Policies via Graph:

PowerShell

Connect-MgGraph -Scopes "Policy.Read.All"

# Query all Conditional Access policies and their operational states
Get-MgIdentityConditionalAccessPolicy | 
    Select-Object id, displayName, state, createdDateTime, modifiedDateTime |
    Format-Table -AutoSize

---

Microsoft Graph Automation

Create Block Legacy Authentication Policy via Graph:

PowerShell

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

$Policy = @{
    displayName = "CA001-Block-Legacy-Authentication"
    state = "enabled"
    conditions = @{
        clientAppTypes = @("exchangeActiveSync", "other")
        applications = @{
            includeApplications = @("All")
        }
        users = @{
            includeUsers = @("All")
            excludeGroups = @("Emergency-BreakGlass-GroupID")
        }
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("block")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $Policy

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Administrators attempting to sign in with SMS or Voice are blocked and prompted for FIDO2 key.

Emergency Break-Glass accounts are confirmed excluded from all active policies.

Legacy authentication protocols (POP3, IMAP4, SMTP Auth) are rejected globally.

Non-compliant or jailbroken endpoints are blocked from accessing Office 365 cloud apps.

Conditional Access What If tool verifies expected policy matching.

Diagnostic Logs & Channels

Tool / Resource	Location	Purpose
Entra ID Sign-in Logs	Monitoring > Sign-in logs > Click sign-in event > Conditional Access tab	Shows every evaluated policy: Result (`Success`, `Failure`, `Not applied`) and unmatched conditions.
Report-Only Insights Workbook	Conditional Access > Insights and reporting	Azure Monitor workbook analyzing user impact of policies operating in Report-Only mode.

---

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
User locked out of all apps	Policy misconfiguration without proper exclusions; trapped by loop.	Sign in using excluded Emergency Break-Glass account and set policy to `Report-only`.
Sign-in shows "MFA failed"	User method does not meet the required Authentication strength (e.g., user used push notification instead of FIDO2).	User must authenticate using FIDO2 hardware key or register security key.
Policy not triggering on mobile	Device platform condition missed iPadOS (iPadOS reports as macOS in Safari by default).	Configure device platform rules covering both iOS and macOS or toggle request desktop website settings.

---

Production Best Practices

Security Caution

Always Exclude Break-Glass Accounts:

A misconfigured Conditional Access policy can lock ALL administrators out of the tenant permanently. Every single policy MUST explicitly exclude an emergency break-glass security group.

---

MS-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

Signal Evaluation Order: All Conditional Access policies apply simultaneously. If any policy evaluates to Block, the user is blocked, regardless of other Grant policies.
Authentication Strengths: Phishing-resistant MFA includes only FIDO2 security keys, Windows Hello for Business, and Certificate-Based Authentication.
Report-Only Mode: Report-only evaluates conditions and logs results to sign-in logs without enforcing blocks or challenges.

---

Official Documentation

PREVIOUS TOPIC2.1 Entra Connect Sync: Password Hash Sync & Staging NEXT TOPIC2.3 Entra Identity Protection: User & Sign-in Risk Policies