Conditional Access Infrastructure

Challenge

To protect cloud resources and sensitive identities, our organization needed a robust Conditional Access framework that could adapt to risk signals, geographic threats, and application sensitivity. The solution had to balance security with flexibility for executive travel and critical operations.

Tools & Technologies

• Microsoft Entra Conditional Access
• Named Locations & IP Ranges
• Risk-Based Policies (Identity Protection)
• Phishing-Resistant MFA (FIDO2, Certificate-based)
• Travel Exception Groups
• Session Controls & Token Lifetime Policies

Policy Highlights

1. Disabled legacy authentication (Microsoft recommendation)
2. Enforced MFA for access to all cloud resources
3. Blocked access from countries with known threat actors using named locations
4. Blocked access from non-business countries with travel exception group
5. Triggered secure authentication flow for users flagged as risky
6. Triggered secure authentication flow for logins from unfamiliar locations
7. Applied custom authentication flow for HR application access
8. Blocked external authentication for critical accounts (e.g., break-glass)
9. Required phishing-resistant MFA for all admin center access
10. Disabled persistent browser sessions and enforced reauthentication every 19 days

Architecture Diagram

Impact