Conditional Access Gaps

A financial data vendor's security policy required MFA for all access and had implemented conditional access policies that restricted access from known high-risk IP ranges. A senior data analyst authenticated to the production data platform from a hotel in an Asian city using their FIDO2 hardware key , satisfying the MFA requirement and not triggering the IP-based risk policy because the hotel's IP range was not flagged as high-risk. The device they were using was their personal laptop , not enrolled in the company's MDM, not subject to the company's endpoint protection policies, not managed by any organizational control. The session downloaded a significant volume of customer financial data to the personal device's local storage. The vendor's conditional access policy had checked authentication strength and IP risk. It had not checked device management status, device compliance, or whether the device receiving the data was under organizational control. The MFA was strong. The conditional access was partial. The data went to an uncontrolled device.

What are Conditional Access Gaps, Really?

Conditional access is a security policy model in which access decisions are made based on multiple contextual signals rather than solely on whether authentication succeeded. The conditions evaluated may include the identity of the user, the strength of the authentication method, the device from which access is requested (managed vs unmanaged, compliant vs non-compliant), the network location of the request, the application being accessed, the risk level of the user's sign-in behavior, and the sensitivity of the data being accessed. A conditional access policy that evaluates all relevant signals for a given access request makes a genuinely risk-based access decision. A policy that evaluates a subset of relevant signals makes a partially informed decision that may allow high-risk access that a complete policy would block.

The device compliance signal is the most commonly missing dimension in partial conditional access deployments. Authentication strength (MFA) and location (IP risk) are straightforward to implement. Device compliance requires MDM enrollment and endpoint management infrastructure , the organization must be managing the device before it can evaluate whether the device is compliant. Organizations that have strong MFA policies but do not require managed device access have a conditional access posture that stops at the authentication gate without evaluating what device the authenticated session runs on, what the endpoint security posture of that device is, or whether the device can be remotely wiped if sensitive data is downloaded to it.

The session risk signal is the second commonly missing dimension. Modern identity platforms provide real-time risk assessment during authentication , detecting impossible travel (authentication from New York followed by authentication from Sydney fifteen minutes later), credential stuffing patterns, anomalous sign-in behavior, and other indicators that the authenticated session may involve compromised credentials. Conditional access policies that incorporate real-time risk signals can block or challenge access when the authentication context suggests credential compromise even if the authentication itself succeeded. Organizations without risk-based conditional access may be blocking authentication from known bad IP ranges while missing the behavioral anomalies that indicate credential compromise from legitimate IP ranges.

• Missing device compliance enforcement , conditional access that evaluates authentication and location without requiring managed, compliant devices
• No real-time sign-in risk evaluation , conditional access without risk-based signals that detect anomalous authentication patterns
• Incomplete application coverage , conditional access applied to primary applications but not all sensitive resources
• Vendor access exemptions , conditional access policies that exempt vendor and service account access from the conditions applied to user access
• No session controls for sensitive access , no download restrictions or session monitoring for high-sensitivity resource access

Why this matters

Conditional access gaps matter for TPRM because they determine whether the access controls that govern how vendor employees and their own internal users access sensitive data are genuinely risk-aware or superficially compliant. A vendor who confirms MFA enforcement and conditional access policies may have policies that satisfy the compliance expectation while leaving significant access risk ungoverned , particularly the device compliance and session risk dimensions that require additional infrastructure investment.

The unmanaged device risk for vendors processing customer data is a specific and consequential gap. When a vendor employee accesses customer data from a personal device, that data is potentially downloaded to a device with no organizational endpoint protection, no remote wipe capability, no DLP to prevent further sharing, and no organizational visibility into what happens to the data on that device. The access event passed authentication. The data that resulted from it is outside any organizational control.

For TPRM practitioners, conditional access assessment requires asking about all the conditions evaluated , not just authentication and IP risk , and specifically asking whether device compliance is a condition for accessing sensitive data and whether personal devices can access production environments with sensitive customer data.

Where most teams get this wrong

The most consistent failure is equating MFA enforcement with comprehensive conditional access. MFA is one condition that conditional access evaluates. Device compliance, session risk, and application sensitivity are additional conditions that a comprehensive conditional access policy evaluates. Confirming MFA without asking about the other conditions describes one dimension of conditional access, not all of them.

• Equating MFA enforcement with comprehensive conditional access
• Device compliance not assessed , whether managed device requirement is enforced
• Personal device access not evaluated , whether personal devices can access production environments
• Sign-in risk signals not assessed , whether real-time risk evaluation is incorporated
• Incomplete application coverage , sensitive applications not covered by conditional access policies

What good looks like

Mature conditional access programs evaluate multiple signals for every access request to sensitive resources , identity, authentication strength, device compliance, location risk, session risk, and application sensitivity , and apply access controls proportionate to the risk profile of the access request.

• Managed device requirement for sensitive resource access , production and sensitive data access restricted to enrolled, compliant devices
• Real-time sign-in risk evaluation , risk-based conditional access that blocks or challenges anomalous authentication patterns
• Personal device restriction for sensitive access , production environments inaccessible from personal, unmanaged devices
• Session controls for sensitive data , download restrictions and session monitoring for high-sensitivity resource access
• Comprehensive application coverage , conditional access policies applied to all sensitive applications, not just primary ones

Tooling

Conditional Access , Microsoft Entra Conditional Access, Okta Adaptive MFA

Microsoft Entra Conditional Access provides comprehensive signal evaluation , user risk, sign-in risk, device compliance (from Microsoft Intune), location, application sensitivity, and authentication strength , for access decisions. Entra's Identity Protection component provides real-time risk signal generation. For TPRM practitioners, asking whether Entra Conditional Access is configured with device compliance requirements and sign-in risk evaluation , not just MFA requirements , provides specific conditional access completeness questions.

Mobile Device Management , Microsoft Intune, Jamf, VMware Workspace ONE

MDM platforms provide the device compliance signal that conditional access requires , confirming that a device is enrolled, meets security requirements, and is under organizational management before granting access to sensitive resources. Without MDM-generated compliance signals, conditional access cannot evaluate device compliance. For TPRM practitioners, asking whether vendor employees are required to access sensitive environments from MDM-enrolled, compliant devices provides a specific device compliance requirement question.

Governance challenges

The governance challenge with conditional access completeness is the infrastructure requirement. Evaluating device compliance requires MDM. Evaluating sign-in risk requires an identity protection platform. Evaluating session risk requires session monitoring infrastructure. Each additional condition evaluated requires investment in the infrastructure that generates the signal. Organizations that have invested in MFA but not in MDM or identity protection have partial conditional access that reflects their infrastructure investment rather than a risk-based access control strategy.

• Ask what conditions are evaluated , authentication, device, location, risk , not just whether conditional access exists
• Ask whether managed device is required for sensitive data access
• Ask whether personal devices can access production environments
• Ask about real-time risk signal incorporation
• Ask about session controls for sensitive resource access , download restrictions and monitoring

If you are a small team

Add one question to your conditional access assessment: can vendor employees access your environment or your data from personal, unmanaged devices , and if so, what controls apply to that access? That question directly tests the device compliance dimension of conditional access that MFA confirmation does not address. If personal device access is permitted without additional controls, the vendor's strong authentication posture coexists with data access on devices outside organizational control.

• Ask whether personal devices can access your environment or data
• Ask what conditions are evaluated in conditional access beyond MFA and IP
• Ask whether MDM-enforced device compliance is required for sensitive access
• Ask about session controls , download restrictions for sensitive data access

What to require

Ask directly:

"Does your conditional access policy require that devices accessing your production environment and sensitive customer data are enrolled in your mobile device management platform and meet your device compliance requirements , or can access occur from personal, unmanaged devices?"

"Beyond MFA and IP-based location controls, what other signals does your conditional access policy evaluate , specifically, does it incorporate real-time sign-in risk signals and device health?"

Expect as evidence

• Device compliance requirement documentation , MDM enrollment required for sensitive access
• Conditional access signal inventory , all conditions evaluated in access policies
• Personal device access policy , explicitly prohibited for production access
• Session control documentation , download restrictions for sensitive data

A vendor who confirms comprehensive conditional access should be asked specifically whether a personal iPhone on hotel WiFi can access their production data platform after successful FIDO2 authentication. If the answer is yes, the conditional access policy evaluates authentication but not device compliance or session context. The authentication gate is strong. The device gate does not exist.

How to evidence it

• Conditional access policy documentation covering all evaluated signals
• Device compliance requirement evidence
• Personal device restriction policy
• MDM enrollment evidence for production environment access

Key Takeaway

Authentication is the gate. Conditional access is the policy that says the gate is necessary but not sufficient. Strong MFA from a personal device on untrusted network accessing sensitive production data is strong authentication and weak access governance , the gate passed the identity, the context failed the risk assessment that a complete conditional access policy would have performed. Device compliance, sign-in risk, and session controls are the conditions that transform authentication from a gate into a comprehensive access decision. Confirming MFA describes one condition. Asking what else is evaluated describes the policy. Ask what else.

More on Security

• API Identity Misuse
• Access Certification Effectiveness
• Access Policy Misconfigurations