Identity as the New Perimeter: Conditional Access

In the Zero Trust model, identity is the new perimeter. Because users access resources from anywhere — home, coffee shops, mobile devices — the network boundary is meaningless as a trust anchor. Instead, every access decision is made based on who is requesting, from what device, under what conditions. The identity provider becomes the gatekeeper, not the firewall.

Conditional Access is a policy engine that grants or restricts access based on signals evaluated at authentication time. Rather than simply verifying a username and password, conditional access evaluates conditions: Is the device compliant? Is the location known? Is the sign-in risk elevated? Is MFA satisfied? Only when conditions are met does the policy engine issue an access token. If conditions fail, access is denied or a step-up challenge is triggered.

Conditional Access policies evaluate multiple signal categories simultaneously. User/group signals identify who is requesting (admin, guest, contractor). Device signals check compliance status from MDM. Application signals identify which app is being accessed (high-sensitivity vs low-sensitivity). Location signals compare the IP address against named locations and trusted countries. Sign-in risk signals from threat intelligence flag suspicious login patterns.

A Conditional Access policy produces one of several outcomes. Grant allows access, possibly with requirements like MFA or device compliance. Block denies access entirely — for example, blocking all access from high-risk countries. Session controls can limit what users do after access is granted: requiring re-authentication after a timeout, blocking downloads, or enforcing read-only mode in cloud applications.

Risk-based Conditional Access integrates threat intelligence into the access decision in real time. Identity providers like Azure AD Identity Protection assign risk scores to sign-ins based on signals like impossible travel (login from two countries within minutes), use of known-malicious IP addresses, leaked credential databases, and anomalous behavior patterns. High-risk sign-ins can be automatically blocked or required to re-verify identity.

Conditional Access can require device compliance as a prerequisite for access to sensitive resources. A compliant device is one enrolled in MDM (Intune, Jamf), running a supported OS version, with disk encryption enabled and no known vulnerabilities flagged by EDR. Unmanaged or non-compliant devices are redirected to an enrollment portal rather than granted access — even if the user credentials are valid.

Named locations in Conditional Access define trusted IP ranges — office IP addresses, branch networks, or VPN exit nodes. Policies can require additional authentication (MFA) for any access from outside named locations, or block access entirely from specific countries or anonymous proxy networks. This adds a location layer to the identity verification without reverting to IP-based perimeter thinking.

Traditional access tokens are valid for their lifetime (often one hour) regardless of what happens to the user account after issuance. Continuous Access Evaluation (CAE) allows the resource provider to revoke tokens in near-real-time when critical events occur — account disabled, password changed, risky user flagged. The application checks token validity during the session, not just at login, closing the gap where compromised tokens remain valid.

Organizations frequently need to grant partners and contractors access without creating internal accounts. Federated identity allows an external identity provider (partner's Azure AD, Google Workspace) to authenticate users and pass verified identity claims. Conditional Access policies can apply to federated users — requiring MFA, restricting device types, or limiting which applications they can access — maintaining control without managing their accounts directly.

Beyond granting or blocking access, Conditional Access can enforce session-level controls. For cloud apps integrated with Microsoft Defender for Cloud Apps or similar CASB (Cloud Access Security Broker) solutions, policies can restrict: block file downloads on unmanaged devices, require re-authentication after 8 hours of inactivity, display warnings when accessing sensitive data, or prevent copy-paste of confidential content outside the corporate environment.

Implementing identity as the perimeter requires integrating several technologies: an Identity Provider (IdP) that supports modern protocols (SAML, OIDC), an MDM/EMM solution for device compliance data, a Conditional Access policy engine, and multi-factor authentication as a minimum baseline. The goal is to ensure no access occurs without verified identity and device posture, regardless of network location — eliminating the concept of a trusted internal network.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: identity replaces the network perimeter as the primary trust anchor in Zero Trust, Conditional Access evaluates multiple signals (user, device, location, risk) before granting access, and session controls and Continuous Access Evaluation maintain security throughout the access session, not just at login. Next up we explore the Zero Trust Maturity Model for planning enterprise-wide adoption.