What does a good Conditional Access programme need to get right?

Why This Matters for Security Teams

conditional access only works when the signals behind the decision are trustworthy. If device posture is stale, location intelligence is noisy, or application risk scoring arrives too late, the policy becomes either overly permissive or so disruptive that users work around it. That creates a familiar failure mode: the control is technically active, but operationally irrelevant. NHI Management Group’s Ultimate Guide to NHIs notes that 90% of IT leaders say properly managing NHIs is essential for successful zero trust, which matters here because conditional decisions depend on identity context, not just perimeter enforcement.

For practitioners, the real issue is policy quality, not policy count. Good Conditional Access programmes define which signals are authoritative, how freshness is measured, and when a step-up is justified. They also separate human convenience from risk tolerance, so the same policy does not treat every session as equal. Current guidance from OWASP Non-Human Identity Top 10 reinforces that identity controls fail when credentials, tokens, and access paths are not governed as dynamic attack surfaces. In practice, many security teams encounter conditional access weakness only after users learn which checks can be bypassed or timed out, rather than through intentional policy design.

How It Works in Practice

A strong Conditional Access programme starts by treating access as a runtime decision, not a static entitlement. The policy engine should evaluate the current session against trusted inputs such as device compliance, sign-in risk, network location, authentication strength, and the sensitivity of the target application. If the signals are fresh and consistent, access is granted with minimal friction. If confidence drops, the policy should step up to stronger authentication, limit session duration, or block access entirely.

That sounds simple, but implementation quality matters. Security teams need to establish which systems are the source of truth for posture and risk, how often those signals refresh, and what to do when they fail. Policies should be explicit enough that operators can predict outcomes, but flexible enough to adapt when a session context changes. NHI Management Group’s 52 NHI Breaches Analysis shows that identity failures often begin with weak visibility and inconsistent control enforcement, which is directly relevant to conditional access because hidden accounts and unmanaged credentials can sit outside the normal policy path.

• Use strong identity proofing and authentication for high-risk applications.
• Require device compliance data that is current, not merely present.
• Differentiate low-risk business access from privileged administrative access.
• Log the full policy decision path so analysts can explain why access was allowed or denied.

For standards-based design, the OWASP Non-Human Identity Top 10 and broader zero trust guidance both point toward continuous verification, but there is no universal standard for exact signal thresholds yet. These controls tend to break down when legacy applications cannot produce reliable posture telemetry because the policy engine is forced to guess.

Common Variations and Edge Cases

Tighter Conditional Access often increases operational overhead, requiring organisations to balance stronger assurance against user friction and helpdesk load. That tradeoff becomes more visible in hybrid estates, contractor-heavy environments, and applications that only support coarse-grained authentication checks. Best practice is evolving, but current guidance suggests that one-size-fits-all policies are usually too blunt for real-world enterprise access.

There are several edge cases that change the answer. Break-glass accounts often need exceptions, but those exceptions should be isolated, monitored, and reviewed separately. Shared devices may require session-based restrictions rather than strict device identity. For third-party access, the right model may be narrower application scopes and shorter session lifetimes instead of broad denial. This is also where NHI and human access patterns can diverge: non-human workloads may need machine identity, token-bound access, or workload-specific policy logic instead of the same sign-in conditions used for employees.

Signal quality is the biggest hidden dependency. If risk scoring is delayed, geolocation is imprecise, or device telemetry is unavailable during outages, the policy should fail safely according to the sensitivity of the resource. Organisations that mix brittle signal logic with critical production access often discover the problem during an incident or audit, when the access policy has already been overridden informally.

Related resources from NHI Mgmt Group

• What do security teams get wrong about ITSM and access governance?
• What do organisations get wrong about user access management audits?
• What do security teams get wrong about asset management and access governance?
• What do security and compliance KPIs often get wrong about access governance?