How Conditional Access decides

If one Conditional Access policy says block and three others say grant with MFA, the user is blocked. The evaluation order explains why. This is the longer version of Sheet 07.

Two phases

Entra evaluates Conditional Access in two phases.

Phase 1 collects session details: the user, the app, network location, device identity, and the rest of the signals a policy might check. It runs for enabled policies and for report-only policies.

Phase 2 enforces, for enabled policies only. Entra looks at every policy that applies. If any of them uses the block control, enforcement stops there and the sign-in is blocked. If not, the user is prompted for whatever grant controls aren't met yet, starting with MFA, then device compliance, then the rest.

Three consequences

• Every applicable policy must be satisfied. There's no priority order and no "most specific policy wins."
• Inside a single policy, assignments combine with AND. Users, target resources, network, and conditions all have to match for it to apply.
• Grant controls inside a policy are either "require all the selected controls" or "require one of the selected controls." Check that setting on every policy you inherit.

The first phase runs for report-only policies too, which is why Sheet 06 pairs reading the report-only results with excluding platforms from compliance policies.

What's the strangest block you've traced back to a policy nobody remembered creating?