A comprehensive map of all conditional access policy components across Microsoft 365 E3 and E5, showing exactly where E5 adds complexity and capability over E3.
Policies follow an IF/THEN model. IF a set of signals and conditions match (user, location, device, app, risk), THEN enforce access controls (block, require MFA, require compliant device, etc.) and optionally apply session controls. E5 adds risk-based intelligence, real-time session proxy, and identity governance that fundamentally expand what "conditions" and "controls" can do.
When multiple grant controls are selected, choose "Require ALL" (AND) or "Require ONE" (OR). Default is AND. Evaluation order: MFA first, then device state, then Terms of Use. E5 adds the "Require password change" grant control for risk remediation, which must target All resources and cannot combine with other controls.
E3 policies are static — they enforce rules based on conditions you define manually (location, platform, group membership). E5 adds dynamic, ML-driven risk signals that adapt in real-time. A sign-in from an impossible travel location or a password spray attack triggers enforcement automatically without predefined rules. E5 also adds real-time session proxy (Defender for Cloud Apps) that can inspect and control what happens inside a session — blocking downloads, redacting sensitive data, preventing copy/paste — capabilities E3 cannot touch.
Select "Require ALL" (AND) or "Require ONE" (OR). Default is AND. Example: Require MFA AND compliant device, or Require MFA OR approved client app. E5 adds "Require password change" for automated risk remediation.
This is the single biggest security upgrade from E3 to E5. Identity Protection uses ML models trained on trillions of Microsoft sign-in signals to detect compromised accounts, suspicious behavior, and attack patterns in real-time. E3 cannot use any risk conditions — it can only enforce static rules.
Each risk detection runs at a specific timing — this determines when it can trigger a Conditional Access policy and how quickly you'll see it in reports.
Evaluated as the authentication happens. Can block or challenge a sign-in before the user gains access. Appears in reports within 5–10 minutes. This is the most protective — Conditional Access policies act immediately.
Calculated after authentication completes, using larger signal volumes that require more processing time. Takes up to 48 hours to surface. The sign-in was already allowed — but the user's risk level is updated retroactively, and CA policies enforce on the next sign-in.
Can fire during the sign-in or after it, depending on available signals. When triggered in real-time, CA policies act immediately. When triggered offline, the risk level updates retroactively and enforces on the next authentication attempt.
Evaluate each authentication attempt. Can trigger MFA or block in real-time.
Click any detection to see its definition
| Detection | Timing | License |
|---|---|---|
| Anonymous IP address | Real-time | Free |
Sign-in from an anonymous IP address (e.g., Tor browser, anonymizer VPNs). These addresses are often used to hide sign-in telemetry for potentially malicious intent. | ||
| Microsoft Entra threat intelligence | Both | Free |
User activity that is unusual for the given user or matches known attack patterns based on Microsoft's internal and external threat intelligence sources. | ||
| Unfamiliar sign-in properties | Real-time | P2 |
Sign-in with properties (IP, ASN, location, device) not seen recently for the user. The system learns a user's typical sign-in behavior and flags deviations. | ||
| Verified threat actor IP | Real-time | P2 |
Sign-in from an IP address known to be associated with nation-state actors or cyber crime groups, as identified by the Microsoft Threat Intelligence Center (MSTIC). | ||
| Password spray | Both | P2 |
The user's password was correctly identified in a password spray attack — where multiple accounts are targeted in parallel with commonly used passwords in a brute-force pattern. | ||
| Anomalous token | Both | P2 |
Abnormal characteristics detected in a session or refresh token, such as unusual token lifetime or a token played from an unfamiliar location. May indicate token theft and replay. | ||
| Atypical travel | Offline | P2 |
Two sign-ins originating from geographically distant locations where the travel time between them would be atypical for the user, suggesting possible credential sharing or compromise. | ||
| Impossible travel | Offline | P2 |
Two sign-ins from geographically distant locations within a time period shorter than physically possible travel. Detected using Microsoft Defender for Cloud Apps data. | ||
| New country | Offline | P2 |
Sign-in from a new and infrequent location that the user has not recently visited. Evaluated based on past activity geography using Defender for Cloud Apps data. | ||
| Malicious IP address | Offline | P2 |
Sign-in from an IP address with a high failure rate due to invalid credentials, or from an IP known to have malicious reputation across Microsoft's threat intelligence. | ||
| Suspicious browser | Offline | P2 |
Anomalous sign-in activity across multiple tenants from different countries in the same browser session, potentially indicating a browser hijack or use of a malicious browser tool. | ||
| Suspicious inbox forwarding | Offline | P2 |
Suspicious email forwarding rules detected — for example, a rule that forwards a copy of all email to an external address. Detected via Defender for Cloud Apps. | ||
| Suspicious inbox manipulation rules | Offline | P2 |
Suspicious inbox rules that delete or move messages and folders were detected, potentially an attempt to hide evidence of a compromised mailbox. Uses Defender for Cloud Apps. | ||
| Mass access to sensitive files | Offline | P2 |
A user accessed an unusually high number of files labeled as sensitive in SharePoint Online or OneDrive for Business. Detected via Microsoft Defender for Cloud Apps. | ||
| Token issuer anomaly | Offline | P2 |
The SAML token issuer for the associated token may be compromised. The claims in the token are unusual or match known attacker patterns for the issuer. | ||
| Activity from anonymous IP | Offline | P2 |
User activity detected from an IP address that has been identified as an anonymous proxy IP address, using data from Microsoft Defender for Cloud Apps. | ||
Cumulative signals that an identity may be compromised. Can force password change.
Click any detection to see its definition
| Detection | Timing | License |
|---|---|---|
| Leaked credentials | Offline | Free |
The user's valid credentials (username and password pair) were found exposed on the dark web, paste sites, or other underground sources. Triggers an immediate risk elevation. | ||
| Microsoft Entra threat intelligence | Both | Free |
User activity that is unusual for the given user or matches known attack patterns based on Microsoft's internal and external threat intelligence sources. | ||
| Anomalous token | Both | P2 |
Abnormal characteristics detected in a session or refresh token, such as unusual token lifetime or a token played from an unfamiliar location. May indicate token theft and replay. | ||
| Anomalous user activity | Offline | P2 |
Baselines normal administrative behavior in Microsoft Entra ID and detects anomalous patterns such as suspicious changes to the directory, unusual enumeration, or atypical admin actions. | ||
| Attacker in the Middle | Offline | P2 |
An authentication session was linked to a malicious reverse proxy, allowing the attacker to intercept credentials and tokens in real time. Detected via Defender for Cloud Apps. | ||
| Possible PRT access attempt | Offline | P2 |
Detected an attempt to access the Primary Refresh Token (PRT) — the key credential for single sign-on on Windows, iOS, and Android. May indicate lateral movement or credential theft via Defender for Endpoint. | ||
| Suspicious API traffic | Offline | P2 |
Abnormal Microsoft Graph API traffic or directory enumeration activity detected from the user's account, suggesting the identity may be compromised and used for reconnaissance. | ||
| Suspicious sending patterns | Offline | P2 |
Suspicious email-sending behavior detected from the user's mailbox, which may risk the account being restricted. Uses data from Microsoft Defender for Office 365. | ||
| User reported suspicious activity | Offline | P2 |
A user denied an MFA prompt and reported it as suspicious via the Microsoft Authenticator app, indicating someone else may have the user's credentials and is attempting to authenticate. | ||
Interactive Policy Evaluation Pipeline. Click any stage to expand and see every component evaluated at that step. Signals flow left-to-right through the engine. Green items are available in E3, amber items require E5.
Request denied entirely. User cannot access the resource. Logged in sign-in logs with failure reason.
All grant controls satisfied. User gets full access to the resource with any applicable session controls active.
Access granted with session restrictions: limited web-only mode, proxied through Defender, sign-in frequency enforced, or token-bound to device.
When multiple CA policies apply to a sign-in, ALL matching policies are enforced (most restrictive wins). Block always overrides grant. Grant controls from multiple policies are combined — if any policy requires MFA and another requires a compliant device, both must be satisfied. Report-only policies are logged but not enforced.
Based on Microsoft's Zero Trust framework. Policies are ordered by protection tier: starting point (E3), enterprise (E3+E5), and specialized security (E5).
| Policy | Conditions | Controls | Tier |
|---|---|---|---|
| Require MFA for all users | All users, All cloud apps | Require MFA | E3 |
| Require phishing-resistant MFA for admins | Admin directory roles, All cloud apps | Require auth strength: phishing-resistant | E3 |
| Block legacy authentication | All users, Client apps = Other clients / EAS | Block access | E3 |
| Require MFA for Azure management | All users, App = Azure Management | Require MFA | E3 |
| Require compliant or hybrid joined device | All users, All cloud apps | Compliant device OR Hybrid joined device | E3 |
| Require approved apps on mobile | All users, Platforms = iOS / Android | Approved client app OR App protection policy | E3 |
| Block from untrusted countries | All users, Location = non-allowed countries | Block access | E3 |
| Restrict unmanaged devices on SPO/EXO | All users, App = SharePoint / Exchange | Session: App enforced restrictions | E3 |
| Require MFA for security info registration | All users, Action = Register security info, Exclude trusted locations | Require MFA | E3 |
| Block device code flow | All users (excl. specific), Auth flow = Device code | Block access | E3 |
| Require MFA for medium+ sign-in risk | All users, Sign-in risk = Medium, High | Require MFA | E5 |
| Require password change for high user risk | All users, User risk = High, All resources | Require password change + MFA | E5 |
| Block high-risk sign-ins for admins | Admin roles, Sign-in risk = High | Block access | E5 |
| Proxy sensitive apps via Defender for Cloud Apps | All users, App = sensitive SaaS apps | Session: CA App Control (Monitor + block downloads) | E5 |
| Block risky service principals | Workload identities, Service principal risk = High | Block access | E5 |
| Require phishing-resistant MFA for PIM activation | Admin roles, Auth context = PIM activation | Require auth strength: phishing-resistant + compliant device | E5 |
Create at least two cloud-only emergency accounts excluded from all CA policies. Use long complex passwords, no MFA, stored offline. Monitor sign-in logs for any use of these accounts.
E3 includes Entra ID P1. E5 includes Entra ID P2 + Defender for Cloud Apps + Microsoft Purview. P2 features can be added to E3 as standalone add-ons.
| Capability | E3 | E5 | What E5 adds |
|---|---|---|---|
| Core Policy Engine | |||
| Conditional Access engine | ✓ | ✓ | Same engine, same if/then logic |
| Report-only mode | ✓ | ✓ | — |
| Policy templates | ✓ | ✓ | — |
| Soft delete & restore (Preview) | ✓ | ✓ | — |
| Signals & Conditions | |||
| Users, groups, directory roles | ✓ | ✓ | — |
| Device platform conditions | ✓ | ✓ | — |
| Location conditions (IP, country) | ✓ | ✓ | — |
| Client app conditions | ✓ | ✓ | — |
| Filter for devices | ✓ | ✓ | — |
| Auth flow control (Preview) | ✓ | ✓ | — |
| Authentication context | ✓ | ✓ | E5 links it to PIM role activation |
| Sign-in risk condition | ✗ | ✓ | ML-driven: 16+ detection types |
| User risk condition | ✗ | ✓ | Cumulative identity compromise score |
| Service principal risk | ✗ | ✓ | Workload identity risk detection |
| Workload identity policies | ✗ | ✓ | CA for service principals |
| Grant Controls | |||
| Require MFA | ✓ | ✓ | — |
| Require authentication strength | ✓ | ✓ | — |
| Require compliant device | ✓ | ✓ | — |
| Require hybrid joined device | ✓ | ✓ | — |
| Require approved client app | ✓ | ✓ | — |
| Require app protection policy | ✓ | ✓ | — |
| Require terms of use | ✓ | ✓ | — |
| Require password change | ✗ | ✓ | Auto-remediation for compromised users |
| Session Controls | |||
| Sign-in frequency | ✓ | ✓ | — |
| Persistent browser session | ✓ | ✓ | — |
| App enforced restrictions | ✓ | ✓ | — |
| Continuous access evaluation | ✓ | ✓ | E5 adds CAE for workload identities |
| Token protection (Preview) | ✓ | ✓ | — |
| CA App Control (reverse proxy) | ✗ | ✓ | Real-time session monitoring via Defender |
| Block downloads / copy / print | ✗ | ✓ | In-session DLP enforcement |
| Block malware uploads | ✗ | ✓ | Threat Intelligence file scanning |
| Identity Protection & Governance | |||
| Identity Protection dashboard | ✗ | ✓ | Risky users, risky sign-ins, risk detections |
| Privileged Identity Management | ✗ | ✓ | Just-in-time admin access with approval |
| Access reviews | ✗ | ✓ | Automated access re-certification |
| Entitlement management | ✗ | ✓ | Self-service access packages |
| Workload identity protection | ✗ | ✓ | Risk detection for service principals |
E3 orgs can add P2 features selectively without full E5. Options: "Entra ID P2" standalone ($9/user/month), "M365 E5 Security" add-on, or "M365 E5 Compliance" add-on. Only users who benefit from P2 features need P2 licenses — you can mix P1 and P2 within the same tenant. However, Conditional Access policies themselves apply tenant-wide regardless of which users hold which licenses.
E3 gives you a robust rule-based policy engine — you define the conditions manually. E5 makes the system adaptive: ML-driven risk signals, automated remediation, real-time session inspection, and governance automation. The jump isn't just more features — it's a different security model. E3 is "configure and enforce." E5 is "detect, adapt, and respond."