Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions learn-pr/achievements.yml
Original file line number Diff line number Diff line change
Expand Up @@ -324,7 +324,7 @@ achievements:
type: trophy
title: MD-102 Manage authentication and compliance
summary: |
This learning path covers the various solutions for managing authentication. Students will also learn about the different types of VPNs, as well as compliance and conditional access policies.
This learning path covers the various solutions for managing authentication. Students will also learn about the different types of VPNs, as well as compliance and Conditional Access policies.
iconUrl: /training/achievements/authentication-compliance.svg
- uid: learn.wwl.protect-identities-azure-acative-directory.badge
type: badge
Expand All @@ -339,7 +339,7 @@ achievements:
- uid: learn.wwl.implement-device-compliance.badge
type: badge
title: Implement device compliance
summary: This module describes how to use compliance and conditional access policies to help protect access to organizational resources.
summary: This module describes how to use compliance and Conditional Access policies to help protect access to organizational resources.
iconUrl: /training/achievements/generic-badge.svg
- uid: learn.wwl.inventory-compliance-reports.badge
type: badge
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Users authenticate to an Azure Machine Learning workspace using one of the follo

- **Managed identity**: When using the Azure Machine Learning SDK v2 on a compute instance or on an Azure Virtual Machine, users can use a managed identity for Azure. This workflow allows the VM to connect to the workspace using the managed identity, without storing credentials in Python code or prompting the user to authenticate. Azure Machine Learning compute clusters can also be configured to use a managed identity to access the workspace when training models. Whenever possible, using a managed identity is the preferred method and best practice.

You can use Microsoft Entra Conditional Access to further control or restrict access to the workspace for each authentication workflow. For example, you can configure conditional access so that an administrator is only able to access an Azure Machine Learning workspace from a managed device.
You can use Microsoft Entra Conditional Access to further control or restrict access to the workspace for each authentication workflow. For example, you can configure Conditional Access so that an administrator is only able to access an Azure Machine Learning workspace from a managed device.

Azure Machine Learning can authenticate with other services using the following methods:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ Client IDs, tenant IDs, and object IDs are identifiers, not secrets. A leaked cl
Microsoft recommends Microsoft Entra ID authentication where possible because it enables centralized identity controls and RBAC. Compared with key-based authentication, Microsoft Entra ID authentication can:

- Grant least-privilege access to users, apps, and managed identities instead of sharing a resource key.
- Use conditional access, identity governance, auditing, and credential lifecycle controls available in Microsoft Entra.
- Use Conditional Access, identity governance, auditing, and credential lifecycle controls available in Microsoft Entra.
- Avoid storing long-lived API keys in app settings, configuration files, scripts, or deployment pipelines.
- Let you rotate or revoke credentials for one identity without replacing a shared key across every workload.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,13 @@

[ ![Screenshot of New Conditional Access policy blade highlighting On for Enable policy at the bottom.](../media/enable-multifactor-authentication/7_inline.png) ](../media/enable-multifactor-authentication/7.png#lightbox)

***Well done!** You created a Conditional access policy that requires users to complete MFA. To check the user experience, sign-in to your application.*
***Well done!** You created a Conditional Access policy that requires users to complete MFA. To check the user experience, sign-in to your application.*
::: zone-end

::: zone pivot="microsoft-graph-api"

#### Create conditional access policy
The following example creates a [conditional access policy](/graph/api/conditionalaccessroot-post-policies?view=graph-rest-beta&tabs=http). This policy targets all sign-ins for all users (except for the tenant's Global Administrator.) In the request below, replace the **{web-or-mobile-app-ID}** with your own web or mobile application (App ID, not object ID.) Note that you can add more applications.
#### Create Conditional Access policy
The following example creates a [Conditional Access policy](/graph/api/conditionalaccessroot-post-policies?view=graph-rest-beta&tabs=http). This policy targets all sign-ins for all users (except for the tenant's Global Administrator.) In the request below, replace the **{web-or-mobile-app-ID}** with your own web or mobile application (App ID, not object ID.) Note that you can add more applications.

```json
POST https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -141,4 +141,4 @@ This model works especially well when device refresh timelines are uncertain or

Windows 365 shifts much of the desktop delivery model away from physical device dependency and toward identity, access, and network performance. This can simplify provisioning for new users, contractors, or seasonal workers, since desktops can be assigned and decommissioned without shipping hardware.

However, this model also places increased importance on identity management, network resiliency, and cloud governance. IT teams adopting Windows 365 should consider how user access, conditional access policies, and endpoint security tooling align with a cloud-first desktop experience.
However, this model also places increased importance on identity management, network resiliency, and cloud governance. IT teams adopting Windows 365 should consider how user access, Conditional Access policies, and endpoint security tooling align with a cloud-first desktop experience.
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
### YamlMime:ModuleUnit
uid: learn.dpu.introduction-to-entra-id-2026.risk-based-conditional-access
title: Risk-based conditional access
title: Risk-based Conditional Access
metadata:
title: Risk-Based Conditional Access
description: This content is part of the "Introduction to Microsoft Entra ID" module.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
In this module, learners explored the core functions of Microsoft Entra ID for managing identities and access in organizational environments. Practical guidance was provided for addressing security challenges and implementing effective identity solutions.

Entra ID centralizes identity and access management across cloud and hybrid environments, strengthens security through multifactor and passwordless authentication, and enables risk-based conditional access to protect organizational resources. It also provides tools for configuring users, devices, and groups, and supports ongoing monitoring of security posture with secure score.
Microsoft Entra ID centralizes identity and access management across cloud and hybrid environments, strengthens security through multifactor and passwordless authentication, and enables risk-based Conditional Access to protect organizational resources. It also provides tools for configuring users, devices, and groups, and supports ongoing monitoring of security posture with secure score.
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,9 @@ Organizations face increasing complexity in securing user identities due to evol
- Operational efficiency
- User convenience

## Benefits of Entra ID
## Benefits of Microsoft Entra ID

Entra ID:
Microsoft Entra ID:

- Provides enhanced security through granular access controls, improved visibility, and adherence to established security practices.
- Improves productivity by enabling streamlined access to organizational resources.
Expand All @@ -48,7 +48,7 @@ Entra ID:

## Secure adaptive access

Entra ID enables organizations to protect access to resources and data using strong authentication mechanisms and conditional access policies based on risk signals. These measures are designed to maintain security without negatively impacting user experience.
Microsoft Entra ID enables organizations to protect access to resources and data using strong authentication mechanisms and Conditional Access policies based on risk signals. These measures are designed to maintain security without negatively impacting user experience.

## Seamless user experiences

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ The following table compares Microsoft 365 Business Standard, Microsoft Office H
| Microsoft Defender for Business | ❌ | ❌ | ✅ |
| Azure Active Directory Premium | ❌ | ❌ | ✅ |
| Data loss prevention (DLP) | ❌ | ❌ | ✅ |
| Conditional access and compliance | ❌ | ❌ | ✅ |
| Conditional Access and compliance | ❌ | ❌ | ✅ |
| Copilot add-on support | ✅ | ❌ | ✅ |
| Admin center and user management | ✅ | ❌ | ✅ |
| Web versions of Office apps | ✅ | ❌ | ✅ |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ From encryption and threat detection to role-based access controls and complianc

- Integrate with Microsoft Entra ID (formerly Azure AD) for identity-based access.
- Apply role-based access control (RBAC) consistently across environments.
- Use conditional access policies for stronger authentication.
- Use Conditional Access policies for stronger authentication.

## Compliance alignment

Expand All @@ -30,7 +30,7 @@ Beyond built-in protections, Azure Local also supports operational security meas

- **Patch automation:** Use update rings to automatically roll out patches in waves, minimizing disruption.
- **Log monitoring:** Centralize logs in Azure Monitor or Microsoft Sentinel for continuous visibility and threat hunting.
- **Access auditing:** Regularly review role assignments and conditional access policies to ensure least-privilege principles are followed.
- **Access auditing:** Regularly review role assignments and Conditional Access policies to ensure least-privilege principles are followed.

## Real-world example

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ Check the prerequisites and plan for the tools that you’ll need to acquire sti
- **Definition & use:** This collection of scores, baselines, and insights reflects the quality of user experience as your organization undergoes digital transformation. You can better detect regressions and proactively support your users throughout configuration changes or disruptions due to legacy hardware.
- **Prerequisites:** Enroll devices via Microsoft Intune or Configuration Manager with a valid Microsoft Intune license. Visit [additional permissions, roles, and access requirements](/intune/endpoint-analytics/?pivots=intune#prerequisites) for your scenario.
- [**Windows Hello for Business:**](/windows/security/identity-protection/hello-for-business/)
- **Definition & use:** This identity protection technology provides security and management capabilities, including device attestation, certificate-based authentication, and conditional access policies. It uses a two-factor authentication method for Microsoft Entra ID and other accounts, combining a device-specific credential with a biometric or PIN gesture.
- **Definition & use:** This identity protection technology provides security and management capabilities, including device attestation, certificate-based authentication, and Conditional Access policies. It uses a two-factor authentication method for Microsoft Entra ID and other accounts, combining a device-specific credential with a biometric or PIN gesture.
- **Prerequisites:** You’ll need one of the following license entitlements: Windows Pro/Pro Education/SE, Windows Enterprise E3/E5, or Windows Education A3/A5. Additionally, review [hardware requirements](/windows/security/identity-protection/hello-for-business/), including biometric sensors.
- [**Microsoft Configuration Manager:**](/mem/configmgr/core/understand/introduction)
- **Definition & use:** This system management solution, as part of the Microsoft Intune family of products, is designed for on-premises and hybrid environments while integrating with Microsoft cloud. It helps simplify deployment of apps, software updates, and operating systems. You can use it to manage servers, desktops, and laptops, as well as compliance settings, with increased IT productivity.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ This integrated approach helps organizations manage AI experiences while maintai
Copilot+ PCs can be managed using familiar tools and frameworks:

- **Microsoft Intune** for device management, compliance policies, and configuration of on-device AI experiences
- **Microsoft Entra ID** for identity, authentication, and conditional access
- **Microsoft Entra ID** for identity, authentication, and Conditional Access
- **Zero-touch deployment** for streamlined provisioning at scale

These tools enable IT administrators to control how AI features are enabled, configured, and used across devices.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ The Zero Trust model is built on three core principles:
| Use least privilege access | Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection. |
| Assume breach | Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defenses. |

For example, a student logging in from home on a shared device, a professor accessing research systems while traveling, or a staff member using a personal device might each introduce different levels of risk. Zero Trust addresses these scenarios through conditional access policies that adapt in real time.
For example, a student logging in from home on a shared device, a professor accessing research systems while traveling, or a staff member using a personal device might each introduce different levels of risk. Zero Trust addresses these scenarios through Conditional Access policies that adapt in real time.

By enforcing explicit verification, limiting access to only what is necessary, and operating under the assumption that a breach has occurred, Zero Trust helps institutions reduce unauthorized access and prevent lateral movement across networks.

Expand All @@ -41,7 +41,7 @@ Microsoft delivers this unified protection through a set of solutions that work
| Microsoft solution | What it does |
|--------------------|--------------|
| Microsoft Defender for Endpoint | Protects endpoints from malware, ransomware, and advanced persistent threats. |
| Microsoft Entra ID | Authenticates users and applies conditional access policies to control access to resources. |
| Microsoft Entra ID | Authenticates users and applies Conditional Access policies to control access to resources. |
| Microsoft Intune for Education | Provides device configuration, app deployment, and policy enforcement through a centralized, cloud-based dashboard. |
| Microsoft Priva | Helps organizations manage personal data and privacy risk and supports compliance with privacy regulations. |
| Microsoft Purview | Provides data governance, classification, and compliance capabilities across the organization. |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,10 @@ Its endpoint detection and response capabilities enable institutions to monitor

## Microsoft Entra ID

[Microsoft Entra ID](/entra/fundamentals/what-is-entra) secures access to resources through strong identity management. It supports single sign-on, multifactor authentication, conditional access, and lifecycle management for students, staff, and visitors.
[Microsoft Entra ID](/entra/fundamentals/what-is-entra) secures access to resources through strong identity management. It supports single sign-on, multifactor authentication, Conditional Access, and lifecycle management for students, staff, and visitors.
By detecting unusual sign-in behavior and enabling passwordless authentication, Microsoft Entra ID reduces the risk of compromised accounts.

Microsoft Entra ID pairs with Windows Hello to provide secure, passwordless access on managed devices, while also supporting personal devices through conditional access policies. This flexibility allows institutions to maintain security without hindering user experience, even in hybrid learning environments.
Microsoft Entra ID pairs with Windows Hello to provide secure, passwordless access on managed devices, while also supporting personal devices through Conditional Access policies. This flexibility allows institutions to maintain security without hindering user experience, even in hybrid learning environments.

**Example:** A teacher travels abroad and attempts to sign in to the school network. Microsoft Entra ID identifies the unfamiliar location and prompts for multifactor authentication to verify the user’s identity before granting access.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ Windows is designed as a platform for work, where interoperability, management c
Here's how Windows ecosystem design translates to practice:

- **Broad hardware choice:** Organizations can select devices based on roles, performance needs, budget, and durability
- **Identity at the platform level:** Microsoft Entra ID integrates deeply into authentication, conditional access, and security posture
- **Identity at the platform level:** Microsoft Entra ID integrates deeply into authentication, Conditional Access, and security posture
- **Integrated management:** Intune and Autopilot provides consistent, cloud-ready provisioning across diverse hardware fleets
- **Enterprise security model:** Hardware-rooted protections, OS safeguards, and Defender intelligence work together as a unified threat posture
- **Ecosystem-wide AI:** Windows supports hybrid AI with local NPUs and cloud AI through Microsoft 365 Copilot and Windows experiences
Expand Down
Loading