Day-10: Conditional Access with Intune (Deep Admin Guide)

Conditional Access – Identity + Device Trust

---

🎯 Objective of Day-10

By the end of Day-10, you will:

• Understand how Conditional Access works internally
• Design safe CA policies
• Avoid mass user lockouts
• Troubleshoot access blocks confidently

---

1️⃣ What Is Conditional Access?

Conditional Access (CA) is a policy engine that evaluates:

• Who is signing in
• From where
• On which device
• Using which app

Then decides:
✔ Allow
✔ Require MFA
✔ Require compliant device
❌ Block

---

2️⃣ Signals Evaluated by Conditional Access

Signal	Source
User identity	Entra ID
Device compliance	Intune
Location	Named locations
App	Cloud apps
Risk	Identity Protection

📌 CA never configures devices — it only checks signals.

---

3️⃣ Where Conditional Access Lives

Steps:

1. Microsoft Entra admin center
2. Protection
3. Conditional Access
4. Policies

---

4️⃣ Most Common Policy: Require Compliant Device

Use case:
Only allow access from managed & compliant devices.

Steps to Create:

1. Create new CA policy
2. Assign Users → Select users/groups
3. Cloud apps → Select apps (e.g. Office 365)
4. Conditions → (Optional)
5. Grant → Require device to be marked as compliant
6. Enable policy (Report-only first!)

---

5️⃣ How “Require Compliant Device” Works

Flow:

1. User signs in
2. Entra ID checks identity
3. Intune reports device compliance
4. CA evaluates result
5. Access allowed or blocked

📌 If device is not enrolled, it is non-compliant by default.

---

6️⃣ Report-Only Mode (CRITICAL)

Never enable CA directly.

Best practice:

• Enable policy in Report-only
• Monitor sign-in logs
• Check impact

📌 Prevents mass outages.

---

7️⃣ Sign-In Logs (Your Best Friend)

Steps:

1. Entra ID → Sign-in logs
2. Filter → Conditional Access
3. Check:
   • Applied policies
   • Grant controls
   • Failure reasons

---

8️⃣ Common Admin Mistakes

❌ Applying CA to “All users”
❌ No break-glass account
❌ No compliance policy exists
❌ Blocking legacy authentication

📌 Always exclude:

• Emergency admin account
• Service accounts

---

9️⃣ Break-Glass Account (Must Have)

Create at least one Global Admin:

• Strong password
• No MFA
• Excluded from CA

📌 Used only during outages.

---

🔟 Intune + CA Best Deployment Order

1️⃣ Enroll devices
2️⃣ Apply configuration profiles
3️⃣ Monitor compliance
4️⃣ Enable CA in report-only
5️⃣ Enforce gradually

---

1️⃣1️⃣ Real-World Scenario

Issue:
User blocked from Outlook.

Reason:
Device not compliant → CA blocked access.

Fix:
Enroll device → Sync → Compliance restored.

---

1️⃣2️⃣ Zero Trust Alignment

Conditional Access supports:

• Verify explicitly
• Use least privilege
• Assume breach

📌 This is Zero Trust in action.

---

✅ End of Day-10 Outcome

You can now:
✔ Explain Conditional Access confidently
✔ Design safe CA policies
✔ Read sign-in logs like a pro
✔ Avoid common admin disasters

---

🔜 Day-11 Preview

Day-11: Security Baselines & Defender for Endpoint

• Intune security baselines
• Windows security baseline overview
• Defender for Endpoint basics
• Admin-ready security foundation