Conditional Access: assignments, conditions (locations, device platforms, client apps, filters for devices, risk), grant and session controls

A Conditional Access policy is an if-then statement evaluated at sign-in, after the first authentication factor. The if part contains assignments and conditions; the then part contains access controls. Every policy that applies to a sign-in is enforced, and if any applicable policy blocks, access is blocked. There is no priority order; controls from all matching policies are combined.