Lets a Conditional Access policy kick in at the moment someone enrols methods for MFA or SSPR, for instance demanding a Temporary Access Pass or a trusted location. Enrolment of Windows Hello for Business and macOS Platform SSO has been covered too since July 2026.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Register security information in context, with comparison tables and the common traps.
Terms in this definition
- Conditional Access
Policy engine in Microsoft Entra ID P1 that, depending on signals such as risk or named locations, allows access subject to controls like MFA or a compliant device, or blocks it.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- MFA
Multifactor authentication: asking for another factor on top of a password at sign-in, usually required by a Conditional Access grant control.
- SSPR
Allows users to unlock or reset their own passwords with methods they have registered. It can apply to All users, None, or Selected (a single group, with nesting supported).
- Temporary Access Pass
A Microsoft Entra ID passcode valid for a limited time, used to onboard users or recover accounts. Its value can be viewed only when it is first created.
- Windows Hello for Business
Sign-in for Windows that needs no password and resists phishing, provided the device has suitable hardware.
- SSO
Signing in once to gain access to multiple applications.