Welcome, and thank you for reading my first blog post.
As someone working in cybersecurity, I started this blog because I'd like to share the knowledge, insights, and experiences I gain along the way. It also motivates me to develop a deeper understanding of the topics I work with. I've always believed that you only truly understand something once you're able to explain it to someone else.
Rather than starting with a complex topic straight away, I'd like to begin with something that sits at the heart of Microsoft's security approach: Zero Trust.
The term Zero Trust already says a lot. It comes down to questioning and verifying everything. In a way, everything is considered suspicious until proven otherwise. We often summarize this mindset with the phrase "Assume Breach."
Instead of assuming your environment is secure, you start from the potential impact of a security breach and work your way back by verifying what led to it. Understanding who requested access, from where, on which device, and under which circumstances becomes essential in that process.
It's equally important that users, applications, and systems are granted only the privileges required to perform their intended tasks.
That's why Microsoft's Zero Trust framework is built around three core principles:
I could easily write an article about each of these principles, but for this first post I'd like to focus on the first one: Verify Explicitly.
And that brings us to the topic I'd like to start with: Conditional Access.
If we look at Microsoft's official documentation, Conditional Access is defined as:
This definition is quite accurate. However, it doesn't fully explain what Conditional Access actually does behind the scenes.
Conditional Access evaluates every access request against a set of organizational policies.
Rather than relying solely on a username and password, Conditional Access allows organizations to make access decisions based on contextual information (signals) such as:
Based on these signals, Conditional Access can:
Traditional security models relied heavily on perimeter-based security.
The process generally looked like this:
Modern work environments have changed significantly.
Users access resources from:
Because of this, access decisions can no longer rely solely on identity.
Organizations must also consider:
Conditional Access provides the mechanism to answer these questions and make intelligent access decisions.
Many people assume Conditional Access is responsible for authentication.
In reality, authentication and Conditional Access are separate processes.
A simplified flow looks like this:
Authentication verifies the user's identity.
Conditional Access evaluates the context surrounding that authentication request.
← Back to Blog