Conditional access
Conditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA. Cyber Essentials does not require it. In Microsoft 365 it is one way to enforce MFA for every user and administrator, as A7.16 and A7.17 require.
- Term
- Conditional access
- Also known as
- Conditional Access policies, Microsoft Entra Conditional Access, Access policies
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term conditional access mean in Cyber Essentials?
Conditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
How does conditional access apply to Cyber Essentials?
In plain terms
Think of a building's door system that is programmed with rules: staff need a pass and a PIN, visitors are only let in during office hours, and nobody gets into the server room from the car park entrance. Conditional access does the same for cloud sign-ins. The best known is Microsoft Entra Conditional Access, used with Microsoft 365. It is a paid feature, and smaller Microsoft 365 tenants can use security defaults instead to switch on MFA for everyone.
What Cyber Essentials asks
The scheme sets the outcome, not the tool. The NCSC requirements say "authentication to cloud services must always use MFA". A7.16 asks whether MFA is applied to all administrators of your cloud services and A7.17 to all users. A No to either is an automatic fail.
Conditional access can deliver that outcome, but only if the rules cover everyone. The word "always" matters: rules that skip MFA for certain users, locations or trusted office networks need careful thought.
At Cyber Essentials Plus, test case 4 has users sign in "on an untrusted device or from an incognito browser session". The test passes only if the user or administrator is "prompted for a form of MFA before access is granted".
Common mistakes
- A policy that covers users but leaves out some or all administrators, or the reverse.
- Exclusions added for a problem months ago and never removed.
- A policy switched to report-only mode, which records what would happen but does not enforce anything.
See the Microsoft 365 and Entra ID setup guide and CE Plus test 4. Related: multi-factor authentication, identity provider, cloud tenant.
Related terms
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
- Credential stuffingCredential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
Frequently asked questions
Conditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
In the 2026 Danzell question set, conditional access comes up at A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Conditional access relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.