// GLOSSARY

Conditional Access

A policy layer that, after authentication, allows access, demands further verification or denies it based on device compliance, location, application and risk signals. It is one of the strongest controls of modern identity security, but its strength and its weakness lie in the same place, its coverage: the policy governs only the requests it evaluates; a client, flow or protocol it does not evaluate can proceed without ever engaging it. The attacker therefore often does not try to break the policy but looks for the path the policy does not see. Typical examples are legacy authentication protocols that can bypass modern conditional-access checks, or unexpected entry surfaces such as the device code flow. This asymmetry forces an important conclusion: the existence of conditional access is not an assurance; what must be tested is whether the policy covers all entry paths, that is, the completeness of its coverage. And that is understood not by reading a configuration list but by controlled testing, by trying whether it can actually be bypassed.