Scale access controls with Microsoft Entra Conditional Access policy plans

What changed

Plans share targeting, conditions and exclusions across individual rules. Each rule is evaluated independently alongside existing policies and appears separately in sign-in logs. Migration retains the original policies and creates new rules in the Off state.

Why it matters

Identity teams can reduce duplicated targeting while preserving granular controls, but shared-condition changes affect every rule in the plan and require careful validation.

Known limitations

• Public preview, not general availability. A Conditional Access Administrator role is required.
• Plan-level exclusions cannot be removed by a rule. Existing policies continue to enforce during migration; new migration and template rules start Off.

Now check

• Verify Entra ID P1 or P2 and open Entra ID > Conditional Access > Policy plans (preview) as a Conditional Access Administrator.
• Pilot one related policy group; review shared conditions and emergency-access exclusions before creating the plan.
• Validate new rules in report-only mode using sign-in logs and impact metrics; turn off original policies only after a verified cutover.