As per the ease of SSO simultaneously it raise security concerns too. However, Microsoft Entra Conditional Access brings signals together, to make decisions, and enforce organizational policies. Conditional Access is Microsoft’s Zero Trust policy engine taking signals from various sources into account when enforcing policy decisions.

Conditional Access policies at their simplest are if-then statements; if a user wants to access a resource, then they must complete an action. For example: If a user wants to access an application or service like Microsoft 365, then they must perform multifactor authentication to gain access.

Signals:

1. User or group membership: Policies can be targeted to specific users and groups
2. IP Location information: Organizations can create trusted IP address ranges that can be used when making policy decisions.
3. Device: Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.
4. Application: Users attempting to access specific applications can trigger different Conditional Access policies
5. Microsoft Defender for Cloud Apps: Enables user application access and sessions to be monitored and controlled in real time.

Common Decisions After receiving the Signals:

1. Block Access
2. Grant Access
3. Suspicious could require further information such as MFA

How to Create a Conditional Access in Azure AD

Conditional Access is found in the Microsoft Entra admin center under Protection > Conditional Access.