# Configuring Entra ID CA Policies for Authentication Flows

<table class="MsoNormalTable" id="bkmrk-field-details-docume" title=""><tbody><tr><td>**Field**</td><td>**Details**

</td></tr><tr><td>Document Type

</td><td>Configuring Entra ID CA Policies for Authentication Flows

</td></tr><tr><td>Applies To

</td><td>Microsoft Entra ID, Conditional Access policy

</td></tr><tr><td>Audience

</td><td>2nd Line / Entra ID Admins / IT Engineer

</td></tr><tr><td>Author

</td><td>AK. Udofeh

</td></tr><tr><td>Last Updated

</td><td>May 2026

</td></tr></tbody></table>

##### **Overview**

This guide outlines how to configure Conditional Access policies in Microsoft Entra ID to control:

<span style="mso-list: Ignore;"> \* </span>Device Code Flow

<span style="mso-list: Ignore;"> \* </span>Authentication Transfer

These authentication methods can introduce elevated phishing and unmanaged device risks if not explicitly governed.

##### **Device Code Flow**

Device Code Flow is similar to signing in to Netflix or Xbox on a Smart TV, where the TV displays a code and instructs the user to complete sign-in on another device such as a phone or laptop. Once authentication is completed, the Smart TV is automatically signed in.

Example:

Example: Go to [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin) or [https://www.netflix.com/tv2](https://www.netflix.com/tv2) and enter this code.

##### **Authentication Transfer**

Authentication Transfer is similar to being signed in on Device A and then scanning a QR code using Device B, allowing the authenticated session or trust to be transferred so that Device B becomes signed in without performing a full standalone authentication process again.

This guide demonstrates how to govern these flows using Conditional Access policies to reduce exposure to indirect authentication attacks.

#####  **Prerequisites**

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;"> \* </span></span>Microsoft Entra ID P1 or higher

<span style="mso-list: Ignore;"> \* </span>Conditional Access Administrator role

<span style="mso-list: Ignore;"> \* </span>Emergency / break-glass accounts identified

<span style="mso-list: Ignore;"> \* </span>Access to Microsoft Entra admin center

**Step 1: Create New Conditional Access Policy**

<span style="mso-list: Ignore;">1. </span>Sign in to the Microsoft Entra admin center

<span style="mso-list: Ignore;">2. </span>Navigate to: **Entra ID &gt; Protection &gt; Conditional Access &gt; Policies**

<span style="mso-list: Ignore;">3. </span>Select **+ New policy**

<span style="mso-list: Ignore;">4. </span>Enter a policy name:

<span style="mso-list: Ignore;"> \* <span style="font: 7.0pt Times New Roman;"> </span></span>Example: CA - Block Authentication Flows

**Step 2: Configure User Scope**

Under **Assignments → Users**:

<span style="mso-list: Ignore;"> \* </span>Include:

All users (recommended)

<span style="mso-list: Ignore;"> \* </span>Exclude:

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;"> \*</span><span style="font: 7.0pt Times New Roman;"> </span></span>Emergency access accounts

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;"> \* </span><span style="font: 7.0pt Times New Roman;"> </span></span>Break-glass administrator accounts

<p class="callout warning">Avoid applying policies to all accounts without exclusions.</p>

**Step 3: Configure Target Resources**

Under **Assignments → Target resources**:

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;">\* </span><span style="font: 7.0pt Times New Roman;"> </span></span>Select:

<span style="mso-list: Ignore;"> \*. </span>**All cloud apps**

This ensures consistent enforcement across Microsoft 365 resources.

**Step 4: Configure Authentication Flows**

<span style="mso-list: Ignore;">1. </span>Navigate to:  
**Conditions &gt; Authentication flows**

<span style="mso-list: Ignore;">2. </span>Set:

<span style="mso-list: Ignore;"> \* <span style="font: 7.0pt Times New Roman;"> </span></span>**Configure = Yes**

<span style="mso-list: Ignore;">1. </span>Select required flows:

<span style="font-family: Segoe UI Emoji;"> \* </span>Device Code Flow

<span style="mso-list: Ignore;"> \* </span>Authentication Transfer

<span style="mso-list: Ignore;">2. </span>Click **Done**

**Step 5: Configure Access Control**

Under **Access controls → Grant**:

<span style="mso-list: Ignore;"> \* </span>Select:

<span style="mso-list: Ignore;"> \*</span> Block access

<span style="mso-list: Ignore;"> \* </span>Click **Select**

This blocks authentication attempts using the selected flows.

**Step 6: Enable Report-Only Mode**

Before enforcement:

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;"> \* </span><span style="font: 7.0pt Times New Roman;"> </span></span>Set policy state to:

<span style="mso-list: Ignore;"> \* </span>**Report-only**

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;"> \* </span></span>Click **Create**

This allows impact analysis without disrupting users.

##### **Validation**

Review:

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;">\* </span><span style="font: 7.0pt Times New Roman;"> </span></span>**Entra ID &gt; Monitoring &gt; Sign-in logs**

Validate:

<span style="mso-list: Ignore;">\* </span>Impacted users

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;">\*</span><span style="font: 7.0pt Times New Roman;"> </span></span>Authentication flow usage

<span style="mso-list: Ignore;">\* </span>Conditional Access evaluation results

Monitor for:

<span style="mso-list: Ignore;">\* </span>Developer tooling dependencies

<span style="mso-list: Ignore;">\* </span>Shared device authentication

<span style="mso-list: Ignore;">\* </span>QR-based onboarding scenarios

##### **Enforcement**

Once validated:

<span style="mso-list: Ignore;">1. </span>Edit the Conditional Access policy

<span style="mso-list: Ignore;">2. </span>Change:

<span style="mso-list: Ignore;"><span style="font: 7.0pt Times New Roman;">\* </span></span>**Report-only &gt; On**

<span style="mso-list: Ignore;">3. </span>Continue monitoring sign-in activity and failures post-deployment.

##### **️ Flow Overview**

User Authentication Attempt  
<span style="font-family: Times New Roman;">\* Authentication Flow Detection</span>  
<span style="font-family: Times New Roman;">\* Conditional Access Evaluation</span>  
<span style="font-family: Times New Roman;">\* Block / Allow Decision</span>  
<span style="font-family: Times New Roman;">\* Resource Access Outcome</span>

Security Control Points:

<span style="mso-list: Ignore;">·<span style="font: 7.0pt Times New Roman;"> </span></span>Device Code Flow restriction

<span style="mso-list: Ignore;">·<span style="font: 7.0pt Times New Roman;"> </span></span>Authentication Transfer restriction

<span style="mso-list: Ignore;">·<span style="font: 7.0pt Times New Roman;"> </span></span>Sign-in logging and monitoring

##### **Summary**

This configuration strengthens Microsoft Entra ID security posture by restricting high-risk authentication flows commonly associated with phishing and indirect access scenarios.