Conditional Access Policy (Extract)

• Deny-by-default
• Device compliance required (managed or attested)
• High-risk sign-ins require phishing-resistant MFA
• Exceptions reviewed with compensating controls and expiry