Forum Discussion
Microsoft Launches Preview for Entra ID Conditional Access Policy Plans
Conditional access policy plans are now available in preview. The idea is to define common rules, conditions like breakglass accounts and have the details inherited by CA policies. Microsoft provides a migration facility to move existing policies to plans, but it’s probably going to take some time for tenants to inventory their current CA policies, understand points of commonality, and slowing move towards rationalization.
https://office365itpros.com/2026/10/29/conditional-access-policy-plans/
1 Reply
A few practical points for anyone trying the migration wizard (Conditional Access > Policies > "Migrate to policy plans" banner):
1. It copies; it doesn't move. Your original policies stay unchanged, and the new rules are created in the Off state. Set them to Report-only, compare each rule with the original policy on the Report-only tab of the sign-in logs, then turn the rules On before turning the old policies Off. Doing it in that order avoids an enforcement gap. Don't edit the originals during validation, or the two copies drift apart.
2. Break-glass exclusions often stay in each rule. "All users" and "All resources" can only be set on rules, not shared conditions, so most baseline policies won't get shared exclusions automatically. Add your emergency access accounts under the plan's shared identities yourself.
3. Inheritance is one-way. A rule can't narrow the plan's targeting or remove a plan-level exclusion. Exclusions accumulate (plan A+B plus rule C gives A+B+C). Shared conditions can't mix users and agents in one plan.
4. Location-based rules: during the preview, plans that target users with a location condition get one-hour tokens without CAE's instant IP check. Keep strict location policies as standalone policies for now.
5. Backups: rules don't appear in Get-MgIdentityConditionalAccessPolicy. Plans have their own beta endpoint, which isn't documented yet:
Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/plans"
A rule only stores its own settings, so always back up the plan together with its rules. If you use CA-as-code (Maester, IaC pipelines), check that it can see plans before you migrate production policies.
6. Evaluation: plan rules and classic policies add up with no precedence. Every applicable one must be satisfied.
Thanks to Rudy Mens (LazyAdmin) for testing the migration behaviour in detail.
Docs: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-plans
