Translated from 日本語 • View original 
**What is Conditional Access? **
This is a function that controls access to services provided on the cloud, such as Microsoft 365, using various conditions.
As a prerequisite, the service you want to control access for must be integrated with Entra ID.
By the way, this is a common misconception, but conditional access is not the idea of "granting access when this condition is met". It is based on the idea of "imposing restrictions when this condition is met".
It is not a whitelist operation, but a blacklist operation.
Even in the image ↑, although access is allowed, some restrictions are imposed, as shown in the preface "but".
Specific Examples
This example shows conditional access that says, "If you want to access App A from outside your company, only allow access from compliant devices."
However, when creating such a policy, it cannot be set as this wording.
In practice, "For [all patterns], a compliant device is required to access App A, but only if accessed from the company's network, it is [not eligible]".
In this way, there are many cases where trying to replace the controls you want to implement in your company with policies in words will not work.
If you try to switch the switch to the idea of "restrict when this condition is met" instead of "allow access when this condition is met", you may be able to set it well.
Conclusion
In this article, we introduced one of the main features of Microsoft Entra ID: Conditional Access.
Proper use can improve the level of security, but this alone does not make it completely safe.
First, if the policy is not properly designed, it will not be effective enough.
There should also be a mechanism to monitor and determine whether access is blocked by a malicious third party or a false positive by a legitimate user.
Tools such as Azure Monitor and Microsoft Sentinel can be used for this monitoring, but the reality is that many companies do not have the resources in-house to perform not only design and construction, but also subsequent operational monitoring.
Therefore, in the "Colorkrew Security" provided by our company,
- Conditional Access policy design advice
- 24/365 alert monitoring
- Analysis and development of countermeasures after an alert occurs
It greatly reduces the burden of security operations.
In addition to Entra ID, it also supports Microsoft's Defender series and the following security products: Achieve integrated monitoring and operations to enhance your security.
- WAF (AWS WAF, Azure WAF, etc.)
- EDR (Cybereason, CrowdStrike, etc.)
- SaaS (Slack, Dropbox, etc.)
- Firewall (Fortigate, Meraki, etc.)
- PC operation logs (SKYSEA Client View, LANSCOPE Endpoint Manager, etc.)
Companies that want to achieve stronger defenses while reducing the operational burden of security should consider implementing Colorkrew Security.