New Conditional Access policy plans in Microsoft Entra

Summary

Microsoft Entra Conditional Access is evolving from a flat list of policies into Conditional Access policy plans. Plans organize access controls around a security objective—such as protecting employees, administrators, or AI agents—rather than requiring administrators to manage each requirement as a separate policy.

How policy plans work

• A plan has a name, description, owner, and tags to clarify its purpose and help manage policy growth.
• Administrators define shared identities, resources, user actions, authentication context, and conditions—such as risk, devices, network locations, and client app types—at the plan level.
• Each plan contains one or more rules. Rules inherit the plan’s shared settings and add their own conditions and grant or session controls.
• Existing Conditional Access policies continue to work while plans are introduced.

Demonstrations and guide

The video walks through several examples in the Microsoft Entra admin center:

1. Create a headquarters access plan: Include the “HQ All Users” group and exclude “Break Glass HQ” to reduce the risk of lockout.
2. Add an authentication rule: Require phishing-resistant MFA for all resources. The example is initially set to report-only.
3. Add a device rule: Require devices to be marked compliant for all resources.
4. Organize agent protections: Create a plan with shared conditions for all client app types and high agent risk, then add rules to block high-risk agent users and autonomous agents. The demonstrated plan was created from a template.
5. Migrate existing policies: Select related branch-office policies and merge them into a plan. The migration process identifies shared settings and converts the selected policies into individual rules.

Migration and cutover

Migration creates a plan without changing or disabling the original policies. Those policies remain enforced according to their existing states until administrators choose to enforce the new plan and turn off or delete the old policies. New branch locations can then be added as rules within the plan.

Main speaker/source: Microsoft Mechanics presenter. The video metadata identifies the presenter as Etan Basseri, Principal Product Manager at Microsoft Entra.