Conditional Access: users and workload identities, cloud apps, conditions (sign-in risk, locations, device platform), grant and session controls, report-only mode

Conditional Access is the policy engine of Microsoft Entra ID. After the first factor of authentication, it evaluates signals about the sign-in and decides whether to allow it, require more, or block it. Think of each policy as an if-then statement: if these assignments and conditions match, then apply these access controls. It requires Microsoft Entra ID P1; risk-based conditions need P2.