What's changed: Created SC-300 Chapter 3 (Domain 2: authentication methods (CBA/TAP/passkeys FIDO2/Authenticator/MFA/SSPR/Windows Hello/password protection/Entra Kerberos); Conditional Access (assignments/controls/session/CAE/authentication context/protected actions/templates/report-only/break-glass exclusion); ID Protection (user/sign-in risk/risky workload id/registration campaigns); Global Secure Access (GSA client/Entra Private Access ZTNA/Entra Internet Access SWG/Internet Access for M365/tenant restrictions)).
3.2Conditional Access
Understand planning/assigning/controlling Conditional Access policies, session management, device-enforced restrictions, continuous access evaluation (CAE), authentication context, protected actions, and creating from templates.
Conditional Access (CA) is the access administrator’s primary tool to implement Zero Trust’s "verify explicitly," dynamically granting/controlling resource access based on signals.
3.2.1Assignments and controls
A CA policy comprises assignments (who: users/groups/roles; what: cloud apps/resources; under what conditions: location/device/risk/client) and access controls (grant: require MFA, compliant device, app protection policy; or block). Always include exclusions (break-glass accounts) to prevent lockout, and validate impact in report-only mode before enabling. Templates deploy recommended policies quickly.
3.2.2Session controls, CAE, and authentication context
Session controls enforce sign-in frequency, app-enforced restrictions, and Defender for Cloud Apps Conditional Access app control. Continuous access evaluation (CAE) revokes sessions immediately on dangerous changes (disable, location change) without waiting for token expiry. Authentication context is a label requiring extra authentication (e.g., phishing-resistant MFA) for specific actions/apps; combined with CA and protected actions, it enforces "strong auth only for the most dangerous operations."
Cues: "grant/MFA/block by compliant device/risk/location" = CA assignments + controls. "validate impact first" = report-only mode. "revoke immediately on dangerous change" = CAE. "extra-auth label for specific actions" = authentication context. "require strong auth for ultra-dangerous ops" = protected actions. Avoid lockout = exclude break-glass accounts.
Watch the mix-ups: (1) Always exclude break-glass accounts from CA (prevent locking out all admins). (2) Report-only mode "records impact without enforcing." (3) Authentication context (extra requirement on actions) and protected actions (gate on Entra operations) work together but are distinct.
3.2.3Section summary
- CA = assignments (who/what/conditions) + controls (grant: MFA/compliant; or block); exclude break-glass + report-only for safe rollout
- Session controls/CAE (immediate revoke)/authentication context (extra-auth label)/protected actions (gate for ultra-dangerous ops)
- Use templates to deploy recommended policies quickly
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Before enforcing a new Conditional Access policy, you want to see its impact on real sign-ins without blocking. Which is best?
Q2. In CA policy design, what is essential to prevent locking out all administrators?
Q3. You want to cut off access the instant an account is disabled, without waiting for token expiry. Which is best?
Q4. You want a label that requires extra phishing-resistant MFA only for specific sensitive operations. Which is best?
Q5. You want to allow access to a specific SaaS app only from compliant devices. Which CA configuration is correct?