Powered by the Microsoft Intelligent Security Graph

With Microsoft Intelligent Security Graph, conditional access gets rich signals gathered from across Microsoft's various consumer- and business-facing interests. It then converts them to actionable risk-based policies.

Comprehensive yet flexible policies with granular controls

Conditional access can define powerful policies to help secure user or group access to applications based on a variety of conditions.

Protect access to apps on-premises and in the cloud

Use conditional access to extend your cloud-powered protection to your on-premises apps in one swift move with Azure Active Directory.

Conditional access + Azure Active Directory Identity Protection detects vulnerabilities and risky accounts, investigates risk events, and creates risk-based policies. 

Extend the same device, location, app, and risk-based protection to guest users as well as customer access to your apps.

Conditional access deeply integrates with solutions across Microsoft Enterprise Mobility + Security to provide greater control and flexibility across data, device, and app access scenarios.

User- and location-based conditional access

Keep sensitive data protected by limiting user access based on geo-location or IP address with location-based conditional access policies.

Device-based conditional access

Ensure only enrolled and approved devices can access corporate data with device-based conditional access.

Work doesn't have to stop when a user is not on the corporate network. Secure access to corporate cloud and on-premises apps and maintain control with conditional access.

Protect your data from malicious hackers with a risk-based conditional access policy that can be applied to all apps and all users, whether on-premises or in the cloud.

Classification and labeling

Classify data based on sensitivity and add labels—manually or automatically.

Encryption and rights management

Encrypt your sensitive data and define usage rights when needed.

Intuitive, one-click process

Apply protection easily without interrupting your employee's normal course of work.

Detailed tracking and reporting

See what's happening with your shared data to gain more control over it. 

Classify your data based on sensitivity

Policies classify and label data at time of creation or modification based on source, context, and content.  Classification with Azure Information Protection is fully automatic, driven by users, or based on recommendation.

Collaborate more securely with others

Share data safely with coworkers as well as your customers and partners. Define who can access data and what they can do with it—such as allowing to view and edit files but not print or forward.

Protect your data at all times

Embed classification and protection information for persistent protection that follows your data—ensuring it remains protected regardless of where it's stored or who it's shared with.

Ease of use

Data classification and protection controls are integrated into Microsoft Office and common applications to secure the data you're working on with one click. In-product notifications such as recommended classification help users make right decisions.

Add visibility and control

Track activities on shared data and revoke access if necessary. Your IT team can use powerful logging to monitor, analyze, and reason over data. 

Deployment and management flexibility

Help protect your data whether it's stored in the cloud or in on-premises infrastructures. You have the flexibility to choose how your encryption keys are managed, including Bring Your Own Key (BYOK) options.

Keep people productive anywhere, on any device

Empower your users to do great work using the devices and apps they love. Deliver mobile experiences that work the way they should, right from the start.

Freedom to work from any device

With Enterprise Mobility + Security, people can work securely from the phone, tablet, Mac, or PC they prefer—whether it's corporate-owned, employee-owned, or a third-party managed service.

Productivity from the start

Use Enterprise Mobility + Security to configure a device with policies and cerificates that allow users to easily access email, Wi-Fi, apps, and other corporate resources—so their preferred devices are ready to go with minimal user setup.

Streamlined access to all apps

Provide the convenience of single sign-on access to thousands of cloud and on-premises applications with one unified identity. This includes Microsoft Office 365 apps as well as support for Salesforce, Concur, Workday, and thousands of other popular SaaS apps.

Self-service capabilities empower users

With Enterprise Mobility + Security self-service capabilities, users can reset their password/PIN, join and manage groups, get access to apps, and invite external partners to collaborate within corporate apps—all without contacting IT.

Ensure that only the right people, under the right conditions, can access your company data. Protect your apps and data always—even after they've been accessed.

Control access to your critical corporate data with policies that you define based on conditions such as user, location, or device state. as conditions and risk change, the controls you set keep your data safe in real time.

App protection

Safeguard your apps and data both before and after access with a rich set of app protection policies, such as the ability to restrict copy/paste and save-as. No device enrollment required: you can enforce app policies even on personal devices.

Enable users to share files securely— internally and externally. Control and track what happens after a file has been accessed, and prevent copying, printing, and other actions to avoid sharing with unauthorized users.

Empower your IT team

Give your administrators the tools and support to manage your diverse mobile ecosystem more strategically and proactively.

Flexible management options

Protect at the user, device, app, and file levels with unmatched flexibility in how you solve for a variety of needs with enterprise Mobility + Security. Extend the reach of your data security by protecting corporate data even on unmanaged devices. 

Cloud architecture that just works

Enterprise Mobility + Security integrates your on-premises infrastructure, taking the worry out of maintenance and updates. Be confident that your system is always up to date and ready to scale globally as your needs change.

Manage everything from a unified console

The Azure-based portal in Enterprise Mobility + Security gives you a unified administrative experience that streamlines the management of core workflows across Intune, Azure AD, and Azure Information protection. You acan also manage devices, users, and groups with nearly unlimited scale.

Deployment planning and ongoing support

Microsoft FastTrack gives you access to a team of engineers dedicated to helping you plan and execute your Enterprise Mobility + Security deployment. And 24/7 global support keeps you running strong day to day. Both services are included with your Enterprise Mobility + Security subscription.

Easy to deploy and manage

Easily provision new PCs with Windows AutoPilot, which deeply integrates with Enterprise Mobility + Security (EMS) to simplify and personalize user's out-of-the-box experience. EMS then automatically configures users' devices according to your organization's policies. 

Always up to date

Keep your devices up to date without the complexity of maintaining an on-premises infrastructure. You can achieve this with aligned Windows 10 and Office 365 ProPlus updates, intelligent insights, and update management from the cloud.

​Intelligent, built-in security

​By embracing the modern management approach, you take advantage of the hardened and integrated security platform in Windows 10 and Office 365 with rich management, security, and data protection capabilities in Enterprise Mobility + Security.

Insights you can use

With rich telemetry and cloud intelligence, you can discover device and app issues before they affect end users, be more confident when applying OS updates, and create powerful reports with your favorite analytics tools. 

The best of both worlds

Incrementally transition to a modern management approach with co-management, which enables you to  manage Windows 10 devices with Configuration Manager agent and Intune MDM at the same time.

Transition at your own pace

With co-management, you can use Intune to manage some workloads, such as device compliance check, while maintaining Configuration Manager for other workloads, such as software distribution.

Configuration Manager and Intune are an integrated solution; they work together  to avoid policy conflicts when managing the same device.

Keep users productive. With co-management, transitioning workloads from Configuration Manager to Intune doesn't disrupt user productivity.

Multi-factor authentication

Conditional access 

Privileged identity management

Mobile device management 

Advanced Microsoft Office 365 data protection 

Windows apps, anywhere

Give access to Windows apps and data from any device and location.

Flexible deployments

Choose from on-premises, cloud-based, or hosted deployments.

Reduced costs

Consolidate your virtual desktop infrastructure (VDI) to improve efficiency.  

Security-enhanced

Protect your sensitive corporate data from loss and leaks.

Extensible platform

Build customized VDI solutions to meet your needs.

Desktop virtualization benefits

• Choose different deployment models to meet your needs: on-premises or in Azure
• Deliver Windows apps on any device: Windows, Mac, iOS, Android
• Scale up or down to meet dynamic business needs by delivering apps from the Azure cloud
• Provide a rich remote user experience similar to applications running on a local PC
• Minimize data compliance by keeping sensitive corporate resources off user devices

Provide seamless access

Centralize identities for each user across apps, groups, and devices. Provide single sign-on to virtually any application used within your organization.

Facilitate collaboration

Extend access to users outside your organization for an easier and more secure way to collaborate and share data. Apply the same policies for employee access to your partners and external team members.

Give users a self-service portal to manage passwords and access to apps and groups. Automate account provisioning and synchronize changes across systems instantly.

Redefine your approach to security with conditional access policies that mitigate risk without disrupting valid users. Reduce the attack surface by limiting privileged accounts and reviewing access rights regularly.

Common identity

Provision your users from an on-premises Active Directory to cloud-based Azure Active Directory to create a common identity to access resources from anywhere.

Easy, secure authentication

Each time an app authenticates a user or device, ensure the process is secure and the user experience is simple.

Increased protection

Tap into security intelligence and machine learning in our cloud solution to offer risk-based conditional access based on the user, location, device, and application.

Business continuity

Maintain all day, every day access to cloud-based applications using the high availability of the cloud and modern authentication methods.

Monitoring and reporting

Get the status of identity infrastructure health and access to centralized user activity reports and audit logs.