Microsoft's NEW Conditional Access Policy Plans Explained

Summary

Microsoft Entra Conditional Access Policy Plans group related Conditional Access rules around a shared security objective, instead of leaving administrators to manage a long, flat list of separate policies. According to the presenter, this can reduce duplicated assignments and exclusions while making policies easier to organize, audit, and maintain.

How Policy Plans work

• A plan is a container for a security goal, such as protecting privileged accounts.
• Shared settings can define common users or directory roles, resources, and conditions for the plan’s rules. For example, an administrative plan might target Global Administrators and exclude emergency-access accounts.
• Rules define individual controls, much like traditional Conditional Access policies. The demo creates rules to require phishing-resistant MFA, require a compliant device, and limit administrators’ sign-in frequency to four hours.
• Shared settings are optional. The presenter recommends using them only when multiple rules genuinely share the same scope.
• The model is additive: rules add targeting and controls. Rules cannot subtract from or narrow inherited shared scope. Changes to a plan’s shared settings affect all its rules.

Demonstration and administration

The presenter creates a “privileged access” plan in the Entra administration center, sets shared scope, and adds rules. Rules can be edited, duplicated, moved to another plan, or deleted individually. Administrators can also change the state of all rules at once.

The demo recommends starting rules in Report-only mode to assess their impact before enabling them.

Sign-in logs remain the main way to check policy results. They show the plan and individual rule, including whether each applied and the result. Clear rule names help administrators interpret the logs.

Migrating existing policies

A preview migration tool can convert existing Conditional Access policies into plans and rules. In the demonstrated migration:

• New rules are created disabled, so administrators can review them and test them in Report-only mode before enabling them.
• Original policies remain in the policy library and continue to operate; migration does not itself disable or replace them.
• The tool attempts to identify common settings among policies, but administrators should review and adjust the resulting plan.

The presenter also refers to a T-Minus365 baseline of roughly 15 recommended controls, organized into categories, as a starting point for reviewing or reorganizing policies.

Preview limitations and cautions

The presenter identifies five issues observed in the preview. These may change in later versions:

1. No lockout warning: The portal did not warn when creating or enabling a rule that could lock out users.
2. Client-app selection issue: In the presenter’s testing, client application types appeared to be set to “all,” limiting the ability to target specific app types, such as legacy authentication.
3. Broad effects from shared-setting changes: Changing shared users, resources, or conditions affects every rule in the plan.
4. Rules cannot narrow shared scope: Once scope is inherited from shared settings, a rule cannot remove or narrow it. Scope must be set appropriately at the rule level.
5. Location-based protections and CAE: The presenter says the preview used standard hourly access tokens rather than Continuous Access Evaluation for location conditions, potentially providing weaker protection for geo-blocking or IP-restriction scenarios.

The presenter advises caution with production use while the feature is in preview and recommends validating scope, testing rules, and checking sign-in logs before enabling policies.

Product mention

The presenter briefly promotes Cloud Capsule, a tool they created for assessing Microsoft 365 configurations and deploying Conditional Access policy templates across tenants. They say support for Policy Plans would follow as the relevant APIs become available and mature.

Main speakers and sources

• Main speaker: T-Minus365 presenter; no personal name is stated in the subtitles.
• Additional product source: The presenter’s description of Cloud Capsule, a tool they created.