Protocol practice· Authorization & Access Models Members
Conditional Access: three asks as policies, tested in report-only first
Objective: Turn the CISO’s three asks into Microsoft Entra policies, then run six real-looking sign-ins through them in report-only, and close whatever gets through.
3 steps4 concepts 10 min
Where Conditional Access fitsNot sure? Which protocol?
What may this app do? · 6 labs
- OAuth
- Token exchange
- Workload federation
- JWT validation
- Just-in-time admin
- Conditional AccessYou are here
What you’ll do
- 1Build the admins’ policy. Four admin roles, one grant control, and two emergency accounts that must never be locked out.
- 2Run six sign-ins in report-only. Admins, a sales rep, an emergency account and a shared mailbox sign in.
- 3Close what got through. One sign-in slips past a policy that looks right.