Azure AD | Roles and administrators | Protected actions (Preview)

Add an additional layer of protection when a user attempts to perform a protected action, they must first satisfy the Conditional Access policies assigned to the required permissions. For example, to allow administrators to update Conditional Access policies, you can require that they first satisfy the Phishing-resistant MFA policy.