Entra Conditional Access Policy Plans Preview Launches

Introduction

Microsoft is adding a major new management layer to Conditional Access with policy plans, now in public preview. For IT and identity teams managing large policy estates, this matters because it shifts Conditional Access from dozens of separate configurations to a more structured, scalable policy management model.

What’s new in Conditional Access policy plans

Policy plans group related Conditional Access policies around a single security objective, such as requiring compliant devices or protecting AI agent activity.

Each plan includes:

• Plan details: Name, description, owners, and tags for accountability
• Shared conditions: Users, apps, and exclusions defined once for the whole plan
• Rules: Individual enforcement scenarios that inherit shared conditions and add specific controls

This new Policy plans (preview) experience appears in the Microsoft Entra admin center under Entra ID > Conditional Access, alongside existing policies.

Key benefits for administrators

Reduce policy sprawl

Instead of creating multiple policies with the same scope, admins can define targeting once and add rules for each requirement. This helps simplify administration while maintaining granular enforcement.

Improve troubleshooting and auditing

Each rule appears separately in the Conditional Access tab of sign-in logs. Admins can trace which rule applied and review the parent plan for shared conditions, ownership, and related controls.

Extend Zero Trust to AI agents

Microsoft is also positioning policy plans as a way to secure emerging identity types, including AI agents. Teams can use shared conditions and templates to apply consistent protection across agent users and autonomous agents.

Migrate at your own pace

A built-in migration option lets admins select existing Conditional Access policies and convert them into a plan structure. Shared assignments move into plan-level conditions, while each original policy becomes a rule. Importantly, original policies stay active and new rules start Off, allowing validation in report-only mode before cutover.

Impact on IT teams

For Entra administrators, this preview offers a practical way to modernize Conditional Access without a risky rebuild. It can help close coverage gaps, reduce duplicated targeting logic, and make larger policy estates easier to govern over time.

Organizations with growing Zero Trust requirements or expanding AI usage will likely find this especially useful.

Next steps

• Review the new Policy plans (preview) experience in the Entra admin center
• Test creating a plan from scratch or from a template
• Use Migrate to Conditional Access policy plans for a small set of related policies first
• Validate new rules in report-only mode before disabling original policies

Conditional Access policy plans are available now in public preview for customers with Microsoft Entra ID P1 or P2 licenses.