Microsoft Entra: migrate Conditional Access policies
Software Development Redmond, Washington
Microsoft Entra administrators can group related Conditional Access policies into a policy plan while keeping the original policies unchanged during migration.
Key insights
- Policy plans collect shared conditions and individual enforcement rules under one security objective.
- The migration creates a new plan; it does not change the selected original policies.
- The migration preview lets admins review shared settings and the rule mapped from each policy.
- The research notes describe the feature as a preview and name Conditional Access Administrator as the required role.
- Generated rules can be set to Report-only for validation before enforcement.
Microsoft Entra policy plans let administrators group related Conditional Access policies around shared conditions and individual enforcement rules. The migration experience creates a separate plan, leaving the selected policies unchanged while administrators review the proposed structure. This matters to Conditional Access administrators consolidating policies that share a security purpose. Microsoft demonstrates the migration topic in a YouTube Short, while the available demonstration transcript contains no spoken or shown steps to verify.
What's new
Traditional Conditional Access policies each hold their own assignments, exclusions, conditions, and controls. Where policies share settings, administrators must maintain those settings in multiple places. Policy plans instead separate common context from individual access decisions.
Shared conditions can include users, applications, exclusions, locations, device platforms, client app types, and risk conditions. Rules define the enforcement scenario, including grant requirements and session controls. A plan must contain at least one rule, and existing policies continue to work independently.
Who it is for and what you need
The migration process is aimed at administrators organizing related Conditional Access policies in Microsoft Entra. The research notes identify the Conditional Access Administrator role as the requirement to create, modify, or delete policy plans. They describe policy plans and the migration experience as preview capabilities.
The materials do not specify licensing, regional availability, or a production-readiness guarantee. Preview functionality may be incomplete or change, so treat a migration as a controlled change and follow your organization’s review requirements.
How it works
- In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies and select Get started in the migration banner.
- Select policies with a common security purpose. The tool analyzes them and identifies shared settings.
- Select Merge policies into a plan, then review the proposed shared conditions and the rule mapped to each selected policy.
- Select Create policy plan and add a name, description, tags, and owners to document its purpose and responsibility.
Before enabling rules, administrators can use Report-only mode and review sign-in behavior. The original policies remain separate and continue to evaluate; the new plan does not automatically replace or disable them.
Limitations and open questions
The supplied materials do not establish licensing or rollout details beyond preview status. They also do not provide the full scope of preview limitations. Review the generated assignments, exclusions, and rule behavior rather than assuming the migration has interpreted every setting as intended.
Keep the original policies until the plan has been validated. Running original policies and enabled plan rules together can affect access decisions, so examine sign-in logs before changing enforcement or removing existing policies.
Sources
Frequently asked questions
What role is needed to create Conditional Access policy plans?
The research notes say the Conditional Access Administrator role is required to create, modify, or delete policy plans.
Does migrating policies to a plan disable the original policies?
No. The migration creates a separate plan and leaves the selected policies unchanged. The originals continue to evaluate independently.
Are Conditional Access policy plans generally available?
The research notes describe policy plans as a preview capability. Licensing and regional availability are not specified in the supplied material.
How can I test a migrated policy plan safely?
Review its generated shared conditions and rules, then use Report-only mode and inspect sign-in behavior before enabling enforcement. Keep the original policies until validation is complete.