Microsoft Launches Preview for Entra ID Conditional Access Policy Plans

A few practical points for anyone trying the migration wizard (Conditional Access > Policies > "Migrate to policy plans" banner):

1. It copies; it doesn't move. Your original policies stay unchanged, and the new rules are created in the Off state. Set them to Report-only, compare each rule with the original policy on the Report-only tab of the sign-in logs, then turn the rules On before turning the old policies Off. Doing it in that order avoids an enforcement gap. Don't edit the originals during validation, or the two copies drift apart.

2. Break-glass exclusions often stay in each rule. "All users" and "All resources" can only be set on rules, not shared conditions, so most baseline policies won't get shared exclusions automatically. Add your emergency access accounts under the plan's shared identities yourself.

3. Inheritance is one-way. A rule can't narrow the plan's targeting or remove a plan-level exclusion. Exclusions accumulate (plan A+B plus rule C gives A+B+C). Shared conditions can't mix users and agents in one plan.

4. Location-based rules: during the preview, plans that target users with a location condition get one-hour tokens without CAE's instant IP check. Keep strict location policies as standalone policies for now.

5. Backups: rules don't appear in Get-MgIdentityConditionalAccessPolicy. Plans have their own beta endpoint, which isn't documented yet:

Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/plans"

A rule only stores its own settings, so always back up the plan together with its rules. If you use CA-as-code (Maester, IaC pipelines), check that it can see plans before you migrate production policies.

6. Evaluation: plan rules and classic policies add up with no precedence. Every applicable one must be satisfied.

Thanks to Rudy Mens (LazyAdmin) for testing the migration behaviour in detail.

Docs: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-plans