Conditional access

A security feature that grants, limits or blocks sign-ins based on conditions such as the user, device, location or risk level of each login attempt.

Conditional access works like a set of if-then rules for logins. For example: if someone signs in from a company-managed laptop in Canada, allow access; if they sign in from an unknown device, require multi-factor authentication; if the sign-in comes from a country where you have no staff, block it. Microsoft Entra ID includes conditional access in certain Microsoft 365 licences, and other identity platforms offer similar features.

This matters because stolen passwords are one of the most common ways attackers get in. Conditional access adds context to the decision, so a correct password alone is not always enough. It can also make life easier for staff by asking for extra verification only when something looks unusual.

Practical tip: if you use Microsoft 365, check whether your licences include conditional access. Common starting policies are requiring multi-factor authentication for all users, blocking older sign-in methods that cannot support it, and adding stricter rules for administrator accounts. Test new policies carefully so you do not lock everyone out.