Conditional Access What-If Matrix
Describe a handful of Conditional Access policies and one sign-in, and see which policies apply, why the others don't, and whether the sign-in is blocked, granted, or granted after MFA. It's a model of the rules Microsoft documents, not Entra's engine: use Entra's What If tool against your tenant before you change a production policy.
Run CA What-If
Inputs stay in this browser and results are not saved.
What this is: A deterministic model of Conditional Access rules Microsoft documents, not Microsoft Entra's policy engine. It doesn't model service dependencies, security defaults, authentication strengths, risk, device filters, guest types or roles. Confirm with Entra's What If tool against your tenant.
Policies (4/12)
Require MFA for all userson · 1 control
Require compliant device on Windows and macOSon · 2 controls
Block legacy authenticationon · Block
Pilot: block access from outside trusted networksReport-only · Block
Access is granted after the user completes: Require multifactor authentication.
Enforced and off policies
- Require MFA for all usersUser action required
- Prompt · Require multifactor authentication: The user is prompted for MFA.
- Require compliant device on Windows and macOSSuccess
- Met · Require device to be marked as compliant: The device is marked compliant.
- Can't be met · Require Microsoft Entra hybrid joined device: The device isn't Microsoft Entra hybrid joined.
Require one of the selected controls.
- Block legacy authenticationNot applied
- Client apps: the client app type isn't selected.
Report-only (logged, not enforced)
- Pilot: block access from outside trusted networksReport-only: Failure
Block access: enforcement stops here and the user is blocked.
Documented rules this model applies
- • All assignments in a policy are combined with AND; a policy applies only when every configured condition is satisfied.
- • Excluding a user or group overrides including it.
- • Network, device platform and client app conditions apply to everything when they aren't configured.
- • Only enabled and report-only policies are evaluated. Report-only policies are evaluated but never enforced.
- • When several policies apply, all of them must be satisfied.
- • A policy with Block access stops enforcement and blocks the user.
- • Multiple grant controls in one policy default to Require all; Require one is an OR.
- • Interactive requirements are prompted in Microsoft's order: MFA, compliant device, hybrid joined device.
- • Legacy authentication clients can't do MFA or pass device state, so those controls block them.
- • Session controls are applied only after all grant controls are satisfied.
For a real tenant, run the scenario in Entra's What If tool (Entra ID > Conditional Access > Policies > What If) and check the sign-in logs.
Sources (checked 9 Nov 2026) · model v2026.11.1
- Microsoft Learn: Build a Conditional Access policy
- Microsoft Learn: Conditional Access users and groups
- Microsoft Learn: Conditional Access grant controls
- Microsoft Learn: Conditional Access conditions
- Microsoft Learn: Conditional Access network assignment
- Microsoft Learn: Report-only mode and policy impact
- Microsoft Learn: The Conditional Access What If tool
Who this Lab is for
Designed for
- Microsoft Entra ID and Intune administrators
- Identity and access engineers
- Help desk leads triaging AADSTS53003 and AADSTS50076
Use it when
- Planning a new policy and checking how it combines with the ones you already have
- Explaining why a user was blocked, or why a policy didn't apply
- Teaching how exclusions, report-only mode and grant controls interact
A complete run, step by step
Describe your policies
Add up to 12 policies. For each, set the state, users and groups to include and exclude, target apps, network, device platforms, client app types, and grant controls.
Describe the sign-in
Enter the user and their groups, the app, the device platform, the named location and whether it's trusted, the client app type, and the device and MFA state.
Read the per-policy results
Not applied policies list every unmet condition. Applied policies show each grant control and why it is satisfied, needs a prompt or fails.
Confirm against your tenant
Run the same scenario in Entra's What If tool (Entra ID > Conditional Access > Policies > What If) and check sign-in logs before enforcing a change.
What you will need
Prepare the following information before starting. Use measured evidence where possible; defaults are examples and should not be treated as recommendations.
Policies
Up to 12 policies, each with a state (On, Off, Report-only), users and groups to include and exclude, target apps, network, device platforms, client app types, grant controls (Block, or MFA, compliant device and hybrid joined device with Require all or Require one) and optional session controls.
Sign-in scenario
The user and their groups, the target app, the device platform, the named location and whether it's trusted, the client app type, and whether MFA is already satisfied and the device is compliant or hybrid joined.
What the result tells you
Your report includes
- Each policy's result: Not applied (with the unmet conditions), Success, Failure or User action required
- The combined decision for the sign-in and the policies that block it
- Interactive requirements in Microsoft's prompt order
- Report-only results shown separately, without affecting the outcome
- Session controls that apply once grant controls are satisfied
Notes on how this lab calculates its results
Pure TypeScript evaluation of rules Microsoft documents: all assignments in a policy combine with AND; excluding a user or group overrides including it; unconfigured network, platform and client app conditions apply to everything; only enabled and report-only policies are evaluated and report-only policies are never enforced; all applicable policies must be satisfied; Block access stops enforcement; grant controls default to Require all, with Require one as an OR; prompts follow Microsoft's order (MFA, compliant device, hybrid joined device); legacy authentication clients can't do MFA or pass device state; session controls apply after grant controls are met. Sources: Microsoft Learn pages on building a policy, users and groups, grant controls, conditions, network assignment, report-only mode and the What If tool, checked 9 Nov 2026. No AI runs when you use the tool.
A deterministic model of Conditional Access rules Microsoft documents, not Microsoft Entra's policy engine. It doesn't model service dependencies, security defaults, authentication strengths, risk, device filters, guest types or roles. Confirm with Entra's What If tool against your tenant.
Model assumptions
- • Group membership, named locations and device state are entered by you; nothing is read from a tenant.
- • Only users and groups, target apps, network, device platforms and client app types are modelled as conditions.
- • Grant controls are limited to Block, MFA, compliant device and hybrid joined device.
- • A noncompliant or non-hybrid-joined device can't be fixed during the sign-in, so those controls count as failures rather than prompts.
Authoritative references
MFA everywhere, compliant Windows and macOS, and a legacy-auth block
Situation
Four policies: MFA for all users except a break-glass group, excluding trusted networks; compliant or hybrid joined device for Windows and macOS (Require one); a block for Exchange ActiveSync and other legacy clients; and a report-only block outside trusted networks. A Finance user signs in to Office 365 from a compliant Windows device on an untrusted network with the desktop apps.
Result
Granted after the user completes MFA. The compliant-device policy is satisfied by the compliant device, the legacy block doesn't apply to modern clients, and the report-only block is shown as Failure without affecting access.
Use the result with engineering judgement
- Not Entra's engine. It doesn't model service dependencies, security defaults, authentication strengths, sign-in or user risk, filters for devices, guest and external user types, directory roles, authentication contexts or token lifetimes.
- Group membership, named locations and device state are what you enter; nothing is read from a tenant.
- Approved client app, app protection policy, password change and terms of use controls aren't modelled.
- A noncompliant or non-hybrid-joined device is treated as a failure, because the user can't fix it at the prompt.
Questions before you begin
Is this the same as Entra's What If tool?
No. Entra's What If tool evaluates your real policies through Microsoft's What If evaluation API. This lab models only the documented rules listed in the methodology, with inputs you type in. Use it to reason about a design, then confirm in Entra.
Why does a report-only Block show as Failure but access is still granted?
Microsoft evaluates report-only policies during sign-in but doesn't enforce them. Their result is logged (Report-only: Failure, for example) and has no effect on access.
Why is the user blocked when a policy only requires MFA?
If the client app type is Exchange ActiveSync or another legacy authentication client, Microsoft documents that it can't do MFA or pass device state, so the requirement can't be met and access is blocked.
Does it store my policies?
No. Everything runs in your browser and nothing is saved or sent.
Ready to run CA What-If?
Open the interactive utility without an account. Inputs and results are not saved.
Open toolGet practical engineering references
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.
Continue from this result
Turn the calculation into an engineering decision
Check the modelled outcome against your tenant's sign-in logs and Entra's What If tool before changing policy.
Read the engineering context
Search all contentBreak-Glass Access: When Your IdP Goes Dark
How Shamir quorum vaults, Conditional Access exclusions, and out-of-band alerting keep break-glass access usable when your IdP itself goes down.
Surviving the Final Domain Controller Cutover
Retiring the last on-prem DC exposes hardcoded LDAP binds, NTLM handshakes, and RADIUS dependencies that Entra ID cloud-only cutover plans routinely miss.
Mobile Application Management for BYOD: MAM Without Enrolment
Use Microsoft Intune mobile application management and app protection policies to protect work data on BYOD devices without requiring full device enrolment.