Stop Copying the Same Admin Exclusions Into Every Conditional Access Policy
TL;DR
- Conditional Access Policy Plans, in preview in Microsoft Entra as of November 2026, group related Conditional Access rules under one security objective with optional shared conditions.
- Shared conditions let you define assignments like administrators included and emergency access accounts excluded once, instead of repeating them in every policy.
- Each rule in a plan is still evaluated independently, and plan rules and standalone policies apply side by side, so every one that applies has to be satisfied.
- Rebuilding an existing policy as a plan rule means both enforce until you disable the original, so validate the new rule first and then turn the old policy off.
- During the preview, keep legacy authentication blocking and IP-based geographic restrictions as standalone policies.
Open the Conditional Access blade in any mature tenant and count how often the same two settings show up: administrators included, emergency access accounts excluded. Now count how many policies you'd have to touch if one of those changed. That repetition is where mistakes creep in, and it's the problem Microsoft is going after with Conditional Access Policy Plans, a new Microsoft Entra feature in preview as of November 2026.
Long policy lists, overlapping assignments and the same exclusions copied again and again make even simple changes risky. Policy Plans add an organizational layer on top of individual policies so related rules can share what they have in common.
What is a Conditional Access Policy Plan?
Until now, every Conditional Access policy has been configured on its own. A Policy Plan groups related rules under a single security objective. Each plan has three parts:
- Plan details: the name, description, owners and tags that define the objective.
- Shared conditions (optional): identity assignments, resources and conditions that every rule in the plan inherits.
- Rules: the actual requirements, such as requiring MFA, requiring a compliant device or limiting sessions.
Take privileged access. A Privileged Access plan could hold three rules:
- Require phishing-resistant MFA for administrators
- Require compliant devices for administrators
- Limit administrative sessions
The administrator assignment and the emergency access exclusion live in the plan's shared configuration, defined once, instead of being repeated across three separate policies.
Sharing configuration doesn't merge enforcement. Each rule is still evaluated independently.
Do plan rules replace the policies you already have?
No, and this is the detail to get right before you migrate anything:
- Standalone policies keep working. Plan rules and standalone policies are evaluated side by side, and every one that applies to a sign-in has to be satisfied.
- Rebuilt policies double up. If you recreate an existing policy as a plan rule, both enforce until you disable the original. Validate the new rule first, then turn the old policy off.
- Sign-in logs stay readable. Each rule shows up separately in the sign-in logs.
- Permissions: creating or editing plans requires the Conditional Access Administrator role.
How would we group a 15-control baseline into plans?
The T-Minus365 Conditional Access security baseline has 15 core controls. Organized by security objective, they fall into six plans:
- Identity & Authentication: MFA and authentication flow protection
- Device & Application Access: device compliance and application restrictions
- Registration & Enrollment: secure device and authentication method registration
- Privileged Access: protecting administrative accounts
- Guest & External Access: controlling access by external identities
- Identity Risk Protection: responding to risky users and sign-ins
Two controls stay out of plans for now:
- Geographic restrictions stay standalone during the preview wherever immediate IP-based enforcement matters.
- Legacy authentication blocking stays standalone until the Client Apps issue covered below is resolved.
A plan doesn't have to use shared conditions at all. You can still set identities, resources and conditions on each rule individually and use the plan purely as a way to group related rules.
What should you watch out for while Policy Plans are in preview?
Hands-on testing turned up five gotchas worth knowing before you touch production policies:
- Missing lockout warnings. Don't rely on the editor to flag a change that could lock you out. Check your emergency access exclusions yourself.
- The Client Apps preview bug. This is the reason to keep legacy authentication blocking as a standalone policy for now.
- Shared changes hit every rule. Edit a shared condition and you've changed every rule in the plan at once.
- Rules can't narrow shared targeting. If a rule needs a smaller audience than the plan's shared assignment, it doesn't belong in that plan's shared configuration.
- The location enforcement limitation. This is why geographic restrictions that need immediate IP-based enforcement stay standalone during the preview.
How should you roll Policy Plans out?
Policy Plans won't make a tenant more secure on their own. What they do is make Conditional Access easier to organize, audit and maintain over time, and that pays off only if the migration is careful:
- Start with one small plan, such as privileged access.
- Run the new rules in report-only mode and check the results in the sign-in logs.
- Once a rule behaves as expected, disable the standalone policy it replaces.
- Migrate the next objective deliberately, one plan at a time.
Microsoft's Policy Plans documentation (opens in new tab) covers the technical details.
What Policy Plans don't fix for MSPs
Policy Plans clean up Conditional Access inside a single tenant. An MSP has the same sprawl multiplied by every customer, and plans do nothing to keep 50 tenants consistent with each other.
That's the gap CloudCapsule fills. You keep your baseline as templates in the CloudCapsule portal, with no golden tenant to maintain. Start from 100+ out-of-the-box policies, or import the policies already running in any customer tenant, then deploy them across customers at scale. After deployment, CloudCapsule keeps watching for drift, so when an exclusion changes or a policy gets switched off in a customer tenant, you hear about it right away instead of during an incident.
Frequently asked questions
Do Conditional Access Policy Plans replace my existing policies?
No. Standalone policies keep working, and they are evaluated alongside plan rules. Every policy or rule that applies to a sign-in has to be satisfied. If you rebuild a policy as a plan rule, both enforce until you disable the original.
What role do I need to create a Policy Plan?
You need the Conditional Access Administrator role to create or edit plans.
How do plan rules appear in sign-in logs?
Each rule shows up separately in the sign-in logs, the same way individual Conditional Access policies do, so you can still see exactly which rule applied.
Keep one Conditional Access baseline across every tenant
Policy Plans tidy up one tenant. CloudCapsule deploys your Conditional Access templates across every customer tenant and flags drift the moment an exclusion changes or a policy gets switched off.
Book a demo
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
