Conditional Access Is Not a Firewall: How Entra ID Conditional Access Actually Works

Conditional Access is not a firewall for Microsoft 365. It is a policy engine in the Entra sign-in and token issuance path, and that difference explains a lot of the confusion people have about how it behaves.