Microsoft Entra

Conditional Access Templates

73 policy templates ready to import into your tenant. Copy the JSON or download the file and use the Entra admin centre to create each policy.

73 policies

Type

Assignment

Tag

Policy	Assignment	Target	Tag
Block access for unknown or unsupported device platform BlockBlock access	All users	All cloud apps	Entra Template
Block access to Office365 apps for users with insider risk BlockBlock access	All users	Office 365	Entra Template
Block agent users with high risk BlockBlock access	All agent users	All cloud apps	Entra Template
Block assistive agent flows with high risk BlockBlock access	All users	All cloud apps	Entra Template
Block high risk agent identities from accessing resources BlockBlock access	Agent identities only	All cloud apps	Entra Template
Block legacy authentication BlockBlock access	All users	All cloud apps	Entra Template
CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist BlockBlock access	All users	All cloud apps	jv-CAF-2026.2.1
CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist BlockBlock access	All users	All cloud apps	jv-CAF-2026.2.1
CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication BlockBlock access	All users	All cloud apps	jv-CAF-2026.2.1
CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows BlockBlock access	All users	All cloud apps	jv-CAF-2026.2.1
CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser BlockBlock access	Specific users	All cloud apps	jv-CAF-2026.2.1
CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms BlockBlock access	Specific users	All cloud apps	jv-CAF-2026.2.1
CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK BlockBlock access	Specific users	f53895d3-095d-408f-8e93-8f94b391404e	jv-CAF-2026.2.1
CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn BlockBlock access	Specific users	All cloud apps	jv-CAF-2026.2.1
CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations BlockBlock access	Specific users	All cloud apps	jv-CAF-2026.2.1
CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess BlockBlock access	Specific users	All cloud apps	jv-CAF-2026.2.1
CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK BlockBlock access	Specific users	Microsoft admin portals	jv-CAF-2026.2.1
CA501-Agents-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskAgent BlockBlock access	All agent users	All cloud apps
CA502-Agents-AttackSurfaceReduction-AllAgentIdentities-AllAgentResources-BLOCK BlockBlock access	Agent identities only	AllAgentIdResources	jv-CAF-2026.2.1
CA504-Agents-IdentityProtection-AllAgentUsers-AllResources-BlockRiskyAgents BlockBlock access	All agent users	All cloud apps
CA505-Agents-AttackSurfaceReduction-AllAgentUsers-AllResources-RequireCompliantNetWork BlockBlock access	All agent users	All cloud apps
CIS - Block device code flow signin BlockBlock access	All users	All cloud apps	CIS
CIS - Block high/medium sign-in risk BlockBlock access	All users	All cloud apps	CIS
CIS - Block legacy authentication BlockBlock access	All users	All cloud apps	CIS
CIS - Block untrusted locations BlockBlock access	All users	All cloud apps	CIS
CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA Require MFARequire MFA	All users	All cloud apps	jv-CAF-2026.2.1
CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA Require MFARequire MFA	All users	All cloud apps	jv-CAF-2026.2.1
CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA Require MFARequire MFA	Specific users	All cloud apps	jv-CAF-2026.2.1
CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA Require MFARequire MFA	Specific users	All cloud apps	jv-CAF-2026.2.1
CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA Require MFARequire MFA · Sign-in frequency enforced	Specific users	d4ebce55-015a-49b5-a083-c84d1797ae8c	jv-CAF-2026.2.1
CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA Require MFARequire MFA	Specific users	All cloud apps	jv-CAF-2026.2.1
CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA Require MFARequire MFA	Specific users	All cloud apps	jv-CAF-2026.2.1
CIS - High user risk Require MFARequire MFA · Sign-in frequency enforced	All users	All cloud apps	CIS
CIS - High/Medium sign-in risk Require MFARequire MFA · Sign-in frequency enforced	All users	All cloud apps	CIS
CIS - MFA for all Admin Roles Require MFARequire MFA	Specific users	All cloud apps	CIS
CIS - MFA for all users Require MFARequire MFA	All users	All cloud apps	CIS
CIS - Non-persistent browser sessions for admins Require MFARequire MFA · Non-persistent browser session · Sign-in frequency enforced	Specific users	All cloud apps	CIS
CIS - Signin everytime for Intune enrollment Require MFARequire MFA · Sign-in frequency enforced	All users	d4ebce55-015a-49b5-a083-c84d1797ae8c	CIS
Require multifactor authentication for admins Require MFARequire MFA	Specific users	All cloud apps	Entra Template
Require multifactor authentication for all users Require MFARequire MFA	All users	All cloud apps	Entra Template
Require multifactor authentication for Azure management Require MFARequire MFA	All users	Azure management	Entra Template
Require multifactor authentication for guest access Require MFARequire MFA	Specific users	All cloud apps	Entra Template
Require multifactor authentication for risky sign-ins Require MFARequire MFA · Sign-in frequency enforced	All users	All cloud apps	Entra Template
Securing security info registration Require MFARequire MFA	All users	Security info registration	Entra Template
CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA Phishing-Resistant MFARequire phishing-resistant MFA	Specific users	Microsoft admin portals
CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA Phishing-Resistant MFARequire phishing-resistant MFA	Specific users	All cloud apps	jv-CAF-2026.2.1
CIS - Phishing-resistant MFA for admins Phishing-Resistant MFARequire phishing-resistant MFA	Specific users	All cloud apps	CIS
Require multifactor authentication for Microsoft admin portals Phishing-Resistant MFARequire phishing-resistant MFA	Specific users	Microsoft admin portals	Entra Template
Require phishing-resistant multifactor authentication for admins Phishing-Resistant MFARequire phishing-resistant MFA	Specific users	All cloud apps	Entra Template
CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ Device ComplianceRequire compliant device · Require hybrid Azure AD join	Specific users	All cloud apps	jv-CAF-2026.2.1
CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant Device ComplianceRequire compliant device	Specific users	All cloud apps	jv-CAF-2026.2.1
CA503-Agents-BaseProtection-AllAgentUsers-AllResources-RequireCompliantDevice Device ComplianceRequire compliant device	All agent users	All cloud apps
CIS - Require managed device Device ComplianceRequire compliant device · Require hybrid Azure AD join	All users	All cloud apps	CIS
CIS - Require managed device to register security info Device ComplianceRequire compliant device · Require hybrid Azure AD join	All users	Security info registration	CIS
Require compliant or hybrid Azure AD joined device for admins Device ComplianceRequire compliant device · Require hybrid Azure AD join	Agent identities only	All cloud apps	Entra Template
Require compliant or hybrid Azure AD joined device or multifactor authentication for all users Device ComplianceRequire MFA · Require compliant device · Require hybrid Azure AD join	All users	All cloud apps	Entra Template
Require MDM-enrolled and compliant device to access cloud apps for all users (Preview) Device ComplianceRequire compliant device	All users	All cloud apps	Entra Template
Require password change for high-risk users Risk RemediationRequire phishing-resistant MFA · Require password change · Sign-in frequency enforced	All users	All cloud apps	Entra Template
CA005-Global-DataProtection-Office365-iOSenAndroid-ClientApps-Unmanaged-AppEnforcedRestrictions Session ControlApp-enforced restrictions	All users	Office 365	jv-CAF-2026.2.1
CA006-Global-DataProtection-Office365-AnyPlatform-Browser-Unmanaged-AppEnforceRestrictions Session ControlApp-enforced restrictions	All users	00000003-0000-0ff1-ce00-000000000000, 00000002-0000-0ff1-ce00-000000000000	jv-CAF-2026.2.1
CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection Session ControlSession controls	All users	00000002-0000-0ff1-ce00-000000000000, 00000003-0000-0ff1-ce00-000000000000	jv-CAF-2026.2.1
CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency Session ControlSign-in frequency enforced	Specific users	All cloud apps	jv-CAF-2026.2.1
CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser Session ControlNon-persistent browser session	Specific users	All cloud apps	jv-CAF-2026.2.1
CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation Session ControlSession controls	Specific users	All cloud apps
CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices Session ControlSign-in frequency enforced	Specific users	All cloud apps	jv-CAF-2026.2.1
CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser Session ControlNon-persistent browser session	Specific users	All cloud apps	jv-CAF-2026.2.1
CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation Session ControlSession controls	All users	All cloud apps
CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency Session ControlSign-in frequency enforced	Specific users	All cloud apps	jv-CAF-2026.2.1
CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser Session ControlNon-persistent browser session	Specific users	All cloud apps	jv-CAF-2026.2.1
CIS - Enforce token protection for session tokens Session ControlSession controls	All users	00000003-0000-0ff1-ce00-000000000000, cc15fd57-2c6c-4117-a88c-83b1d56b4bbe, 00000002-0000-0ff1-ce00-000000000000, 9cdead84-a844-4324-93f2-b2e6bb768d07, 0af06dc6-e4b5-4f28-818e-e78e62d137a5	CIS
CIS - Require periodic reauthentication for all users Session ControlSign-in frequency enforced	All users	All cloud apps	CIS
No persistent browser session Session ControlNon-persistent browser session · Sign-in frequency enforced	All users	All cloud apps	Entra Template
Use application enforced restrictions for O365 apps Session ControlApp-enforced restrictions	All users	Office 365	Entra Template