← All projects

IAM Engineer

Azure Conditional Access Lab

A reproducible Conditional Access policy set covering baseline MFA, device compliance, risk-based controls and break-glass exclusions.

  • Entra ID
  • Conditional Access
  • Identity Protection
  • Intune
  • Terraform

Architecture

grantblocksessionSignalsUser / GroupApplicationLocationDevice StateUser & Sign-In RiskSign-In EventConditional Access EngineAccess + MFA / CompliantDeviceAccess DeniedSession Controls

Overview

Codified a 12-policy Conditional Access baseline that covers the most common attack paths: legacy authentication, unmanaged devices, risky sign-ins and admin-tier elevation.

Each policy is delivered via Terraform with a paired report-only twin so changes can be observed in production before being enforced.

Policy set

  1. P01 — Block legacy authentication (global).
  2. P02 — Require MFA for all users.
  3. P03 — Require compliant or hybrid-joined device for Microsoft 365.
  4. P04 — Block sign-ins from high-risk locations.
  5. P05 — Require phishing-resistant MFA for admin roles.
  6. P06 — Sign-in risk: medium → MFA, high → block.
  7. P07 — Session: persistent browser disabled on unmanaged devices.