Conditional Access is an essential component of "Azure Active Directory" and assumes the role of the "Zero Trust Policy Engine" in Microsoft 365 environments.

Therefore, configuration management of the policies has become a critical and important part for Identity Administrators and Security Operations.

Microsoft Graph API offers programmatic access to Conditional Access which is the foundation to configure policies "as code".

In this session we will do a walkthrough of automation solutions to manage deployment and operations of Conditional Access at scale across the DevOps lifecycle.
During the hands-on demos we will discuss my PoC project "AADOps" which shows the capabilities in automation and lifeycle management by using Azure DevOps (Repos and CI/CD pipelines), PowerShell and Microsoft Graph.

1. Overview of Microsoft Graph & Conditional Access
- Existing automation and workflow solutions
- Considerations of "Policies as Code"

2. Introduction of "AADOps" project
- Advantages of "IdentityOps" approach
- Security design and RBAC of Azure DevOps project

3. Coding & deployment of policies
- Plan and code policies in "Azure Repos"
- Defined policy templates and variables
- Governance by automated validation and approval workflow
- Pull/Push Pipeline to manage desired state
- Safe rollout of policies across intra- and inter-tenant stages

4. Operationalization of policies in Azure AD management
- Operational Insights and Exclusion Management
- Security Monitoring of Policy management