Conditional Access Policies

Zero Trust Persona-based Azure AD Conditional Access Policies

Based upon the excellent Microsoft Learn: Conditional Access architecture and personas and Framework and policies pages authored by Claus Jespersen.

Note that for clarity, I have deviated to the following naming convention:
CANumber-Persona-PolicyType-App/User Action-Condition-AccessControl

This collection is a work in progress.

• CA1XX-Admins
  • Require FIDO2 Security Key or TAP
• CA2XX-Internals
  • Registering Security Information
  • Using Android or iOS
  • Using Azure Management
  • Using Legacy Authentication Clients
  • Using Unknown or Unsupported Devices
  • With High Sign-in Risk
  • With High User Risk
• CorpServiceAccounts
  • In Unknown or Untrusted Locations
  • Not Accessing O365 or Azure
  • Using Legacy Authentication Clients
  • With High Sign-in Risk
  • With High User Risk
• Developers
• Guests
  • Registering Security Information
  • Require MFA
  • Session Limit
  • Using Legacy Authentication Clients
  • With High or Medium Risk
• Administrator Roles
  • Require Phishing-Resistant MFA