Conditional access
The identity provider's rule engine that grants, steps up to a second factor or blocks each sign-in based on account, device, location and risk; it is where declared MFA is actually enforced, or not.
Conditional access is a rule engine that decides, at every sign-in, whether a user gets into an application, has to present a second factor first, or is blocked, based on signals such as the account, the device, the location and the session's risk level. The name comes from Microsoft, whose Conditional Access feature in Entra ID (Azure Active Directory until 2023) is the most widespread; Okta, Google and other identity providers offer the equivalent. This is where the MFA (multi-factor authentication) declared on the questionnaire becomes real, or doesn't. A common setup requires MFA for all users on all cloud apps, blocks legacy authentication (IMAP, POP, basic-auth SMTP), which cannot present a second factor, and limits email to managed devices. Everything hinges on the exclusions. An "MFA exceptions" group opened for a traveling executive, a service account, a copier that sends email: each one is a door, and password spraying finds them. In January 2024 Microsoft itself disclosed that Midnight Blizzard, a group tied to Russian intelligence, had gotten in that way through an account on a legacy, non-production test tenant that had no MFA. Report-only mode is another trap: the rule shows up in the console and enforces nothing. Underwriters therefore ask more often for a screenshot of the policies or a configuration export than for a plain yes, and some questionnaires ask how many accounts are excluded from MFA. A practitioner's caveat: conditional access only sees what goes through the identity provider. A VPN that authenticates elsewhere, an exposed server or a local account stay outside its reach.
Textbook case, made-up figures: a company with 800 accounts answers "MFA on all email." The export of its conditional access policies shows an MFA rule applied to everyone except an exclusion group of 37 accounts: 30 service accounts, 5 shared mailboxes and 2 executives. Legacy authentication is not blocked. Actual coverage is 763 accounts out of 800, or 95.4%. What the underwriter takes away is that the 37 excluded accounts open with a password alone from the internet; he sends a follow-up question and waits for the block before inception.
conditional access, conditional access policy, conditional access rules, Entra ID conditional access
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.