Why the sign-in rules change depending on where you are

What it is

Conditional access is a set of rules that decides what happens when someone signs in to a work account. Instead of treating every sign-in the same way, the system looks at the circumstances:

• Who is signing in, and what their role is.
• Which device they are using, and whether the company manages it.
• Where they are, based on location and network.
• What they are trying to reach, such as email or sensitive files.
• How risky the sign-in looks, for example if the password has been seen in a breach.

What you might notice

• No extra prompt on your usual company laptop at the office.
• A request for a sign-in code on a new device or network.
• A block when signing in from a country your business does not operate in, or on a personal device when company policy requires a managed one.
• Limited access, such as being able to view files in a browser but not download them.

Why it helps

A stolen password alone is not enough to get in if the rules require a known device or a second step. Attackers often sign in from unfamiliar places and devices, which is exactly what these rules look for.

If a rule blocks you somewhere you genuinely need to work, such as on a trip, tell IT in advance. They can plan for it.