Conditional Access

Conditional Access is the front door of a Microsoft 365 tenant. It is also one of the hardest controls to be sure about, because the Entra portal can only show you what you declared - the policies, the named locations, the trusted ranges. It cannot show you what actually happened at the door: which places your people really sign in from, which of those places no policy covers, and which sign-ins completed with no policy in force at all.

1Security answers that second half. It reads your Conditional Access configuration, lays it over the locations it already observes from your audit logs, and reports the difference: "you said this; your tenant does that."

What You Can Achieve

What 1Security Reads

Three inputs, all read-only:

• Named locations - the IP ranges and countries you declared in Entra, including which are marked trusted.
• Conditional Access policies - their state (enabled, report-only, disabled), their grant controls, and which named locations they include or exclude.
• The per-sign-in verdict - which policies Microsoft applied to each sign-in, and with what result. This one is free: it already travels inside the sign-in records 1Security ingests, so no extra permission or API call is involved.

The first two need the Policy.Read.All permission, which rides a re-consent of the read-only application you already granted - not a new app registration. 1Security never writes Conditional Access configuration; every remediation this screen points at is performed by you, in Entra.

Connecting It

Open Locations → Conditional Access and grant the permission from the card shown there (the same card lives on the Integrations screen). Within the next sync 1Security pulls your configuration, matches it against every location it has already resolved, and fills the tab in.

Two clocks run afterwards, deliberately at different speeds:

• Configuration is refreshed every few hours. Policies change a handful of times a quarter, and when they do change, the event already reaches you in real time through the audit log - policy.ca.create, policy.ca.update and policy.ca.delete are ingested as high-severity activity.
• Coverage is recomputed hourly, because the other side of the comparison never stops moving: new locations appear, new sign-ins are attributed, and yesterday's verdict goes stale on its own.

How Coverage Is Decided

Every observed location gets one verdict, computed from the source addresses actually seen there - not from the policy's stated scope:

"Partly covered" is the verdict most worth understanding. A declared range that covers four of a site's nine egress addresses looks correct in the portal, and the other five reach Microsoft 365 from outside every rule that mentions it.

The Findings

The verdict says covered or not. These findings say why you should act, and a location can carry several at once:

• No enforcement - sign-ins here completed with no Conditional Access policy in force at all. Measured from real sign-ins, not inferred from configuration.
• Undeclared, active - meaningful, sustained activity from a place no named location covers. Thresholded on events and distinct users so one-off traffic doesn't bury the genuine gaps.
• Office not trusted - you marked this as a company office, but it sits outside every trusted named location. Read either way: your rules treat the office as hostile, or the office is missing from the exception list it was meant to be in.
• Trusted, risky network - a range Entra marks as trusted resolves to VPN, Tor, or hosting infrastructure. Trusted status is a standing exception in every policy that excludes trusted locations, so this hands that exception to whoever rents the address next.
• Range outgrown - only part of this location's source addresses fall inside the declared range.
• Ungoverned anonymised egress - anonymised or hosted egress with real activity and no policy observed applying to it. Either half is common; together they are worth a look.

Tenant-wide tiles count the locations carrying each finding, alongside the share of sign-ins with no policy applied - the single number that says how much of your traffic walks in ungoverned.

Named Locations: The Other Direction

The Named locations view turns the comparison around and starts from what you declared, so config that never meets reality can't hide:

• Never seen - nothing has ever signed in from a declared range. A trusted range nobody is behind is a standing exception with no owner.
• Referenced by - how many enabled policies reference this named location. None means the declaration is dead config.
• Unreadable ranges - ranges Microsoft returned in a form that could not be parsed as CIDR. They are shown rather than swallowed, because an unmatchable range would otherwise make its named location look like it covers less than it does.

In a Location's Drawer

Open any location and its Conditional Access tab tells the story for that one place: the coverage verdict and the named location behind it, how many of its observed addresses matched the declared range, how many sign-ins were attributed here and how many carried no policy, every finding with an explanation - and the policies actually observed acting on sign-ins from this location, each with its grant controls and its counts of applied, allowed, blocked, and report-only.

Policies are listed as observed, so the tab is honest in two directions that a config view cannot be: report-only and disabled policies are labelled rather than counted as protection, and a policy that has since been deleted in Entra still appears, tagged - "the rule that used to cover this office was deleted" is a finding, not a missing row.

Where Else It Shows Up

• Locations list - a CA coverage column rides the main list, not just the Coverage tab: whether a place is governed belongs next to the place, wherever you are looking at it.
• Filters - narrow any location list by coverage verdict or by a specific finding.
• Location drawer - the Conditional Access tab described above.

Honest Limits

• Coverage is computed from observed sign-ins. A policy that is configured correctly but has never had a sign-in to act on will show no observations - that is a statement about your traffic, not a claim that the policy is broken.
• 1Security reads Conditional Access; it never edits it. Every fix - adding a range, trusting an office, retiring a dead named location - happens in Entra.
• Locations discovered since the last recompute show as Undetermined until the next hourly pass, rather than being reported as gaps they may not be.

See Location Intelligence for how the places themselves are resolved, and Devices for the device side of the same sign-in story.