Microsoft Entra: manage Conditional Access policy plans
Microsoft 365 Expert, Author, YouTuber, Speaker & Senior Technology Instructor (MCT)
Conditional Access policy plans organize identities, resources, conditions, and controls in one workflow for Entra administrators.
Key insights
- Policy plans let admins combine identities, resources, conditions, and access controls in one workflow.
- The demo creates a policy plan in reporting-only mode, where it is evaluated but not enforced.
- Agent identity blueprint registration is enabled by default in the user settings shown.
- Conditional Access conditions shown include device platforms, network locations, risk, and device filters.
Microsoft Entra Conditional Access policy plans give administrators a workflow for assembling access policies from identities, resources, conditions, and controls. They matter to identity and security administrators who build or review Conditional Access rules. Andy Malone [MVP] demonstrates the policy-plan workflow alongside settings for agent identity blueprints, OneDrive sharing, and Exchange Web Services.
What it does
A policy plan brings several policy-building choices into a single interface. Instead of starting with a template, the administrator can create a plan, name it, add owners and tags, and select the identities and resources it should cover. The workflow then lets the administrator define conditions and the response to a matching sign-in.
The identity choices shown include users and groups, workload identities, and agents. The resources can be applications, user actions, or authentication contexts. The demonstration also shows conditions for user and sign-in risk, insider risk, device platforms, network locations, client app types, and device attributes.
The policy can apply access controls such as blocking or allowing access, requiring multifactor authentication or an authentication strength, and requiring a compliant device. Session controls include setting a sign-in frequency. The finished plan can be reviewed for sign-in results and exported or viewed as JSON, according to the demonstration.
Who it is for and what you need
The policy-plan workflow is aimed at administrators managing Conditional Access in Microsoft Entra. The transcript does not state a required license for creating a plan. It does say Identity Protection features such as user risk and sign-in risk require an Entra ID P2 license.
Some choices depend on the tenant’s configuration. For example, selecting network locations assumes those locations have been set up. The speaker also notes that adding agents in the demonstrated workflow requires a Microsoft Copilot license; the demonstration tenant did not have one, so that option was not tested.
The transcript does not identify a rollout stage, preview status, regional scope, or licensing requirements for policy plans themselves. It also does not provide a Microsoft announcement or documentation link confirming general availability. Treat the described interface as what was demonstrated, not proof that every tenant has the same options.
How it works
- In the Microsoft Entra admin center, open Conditional Access and choose Policy plans. Start a plan rather than creating one from a template.
- Give the plan a name and, if useful, a description, owners, and search tags. Select the identities to include, such as users and groups or workload identities, and configure any exclusions.
- Add the shared resources. The demonstrated choices include applications, user actions, and authentication contexts; the example selects Microsoft 365 and admin portals.
- Choose conditions, such as device platforms or network locations. Device filters can use attributes such as ownership, manufacturer, or model. The demonstrated example includes company device ownership.
- Set grant or block controls and any session controls. The example requires an authentication strength and uses a sign-in frequency control.
- Name the rule and select its state. The example uses reporting-only mode, which the speaker describes as evaluated and reported but not enforced. Create the plan and review its results as sign-ins occur.
Reporting-only mode is useful for observing how a policy evaluates before it is enforced, but the demonstration does not provide a formal deployment checklist or explain how to migrate existing policies. Review the plan’s scope and results in your own tenant before deciding whether to enforce it.
Limitations and open questions
The other demonstrated changes are relevant to administrators but are separate from the policy-plan workflow. In Entra user settings, the speaker finds an option allowing users to register agent identity blueprints and says it is enabled by default. Administrators who do not want users to create these blueprints should review that setting and switch it off, based on the behavior shown.
For OneDrive sharing, the demonstration shows a refreshed sharing interface, link choices for anyone, people in the organization, or specific people, and a control for whether people with edit access can reshare. The speaker notes that tenant sharing settings can disable the anyone option. The advanced settings route back to older SharePoint settings in the demonstration.
For Exchange Online, the demonstrated route is Microsoft 365 admin center > Settings > Org settings > Security & privacy > Baseline security mode. Its Authentication section includes an option to block Exchange Web Services (EWS). The speaker recommends considering it after migration from older Exchange versions; the transcript does not detail dependencies, exceptions, or the impact on particular clients.
These interface observations do not establish rollout timing or availability across tenants. The video also does not give a detailed migration procedure for existing Conditional Access policies or explain how policy plans interact with every existing policy. Confirm behavior and requirements in your tenant before changing access or disabling a service.
Sources
Frequently asked questions
Where do I find Conditional Access policy plans?
The demonstration opens the Microsoft Entra admin center, goes to Conditional Access, and selects Policy plans.
Can I test an Entra policy plan before enforcing it?
The demonstrated plan is created in reporting-only mode. The transcript describes this as evaluated and reported but not enforced.
What license is needed for Conditional Access policy plans?
The transcript does not state a license requirement for creating policy plans. It says Entra ID P2 is needed for Identity Protection risk conditions such as user risk and sign-in risk.
Can standard users register agent identity blueprints?
The demonstrated Entra user settings show this permission enabled by default. Administrators can switch it off if they do not want users to register blueprints.