Conditional Access

In plain language

A checkpoint on every sign-in to Microsoft 365 that can block it, allow it, or ask for more proof.

The metaphor

Like a doorman who checks your ID, your name on the list and whether you came in the right door, not just your ID.

Going deeper

How it works

Each sign-in is checked against rules your administrator sets.
A rule can require MFA, an approved computer, or a sign-in from Canada.
Risky sign-in methods can be blocked outright, including the "enter a code on another device" trick attackers use.
It needs P1 (Microsoft Entra ID P1), which comes with Business Premium.

What can go wrong (example scenario)

A staff member types a code into a fake Microsoft page. Without Conditional Access, the attacker's computer is accepted. With it, the sign-in is refused because the computer isn't approved.

How WILDCARD handles it

Cloud covers setting these rules once your licences include them.

In practice

Block sign-ins from outside Canada.
Require MFA for every admin.
Only company computers can open email.

A question owners ask

We already have MFA. Why do we need this?

Because MFA checks the person, and Conditional Access checks the whole sign-in. Attackers now trick people into completing MFA for them.

Where WILDCARD handles this

Cloud

Start with Cloud

Related terms

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →