Key Points
- Conditional access enforces context-aware control by evaluating identity, device compliance, location, and risk at login.
- Extended access defines how long and how broadly access continues after authentication, including VPNs and remote sessions.
- Conditional access reduces risk at entry, while extended access can increase exposure if sessions persist without reassessment.
- Effective risk modeling requires limiting session duration, enforcing least privilege, and segmenting sensitive resources.
- Monitoring extended access sessions is essential to detect lateral movement, abnormal behavior, and privilege escalation.
- A layered strategy combines conditional access with scoped extended access to support Zero Trust and maintain efficiency.
Many organizations deploy multiple access control mechanisms, but their roles are not always clearly defined in practice. Recent findings from Microsoft Security highlight this shift, with 96% of organizations considering Zero Trust adoption critical to their success and 73% planning to increase investment in the coming years. Without clear distinctions between these controls, organizations can end up with overlapping policies, inconsistent enforcement, and increased exposure to risk.
Two of the most used approaches, namely, conditional access and extended access, serve important and distinct roles in an identity and remote access strategy, but are frequently treated as interchangeable. Understanding conditional access versus extended access is essential for designing secure yet operationally practical access controls.
What conditional access architecture enforces
Conditional access policies look at multiple contextual factors in real time to determine whether a user should be granted access or not, and under what conditions. This ensures access decisions are adaptive and aligned with the risk posture of the point of entry.
This mechanism evaluates various signals for access decisions:
- Verification of the user’s identity and authentication strength (for example, requiring multi-factor authentication for privileged accounts)
- Assessment of whether the device meets security compliance standards (for example, allowing access only from devices with up-to-date patches and endpoint protection)
- Consideration of the user’s geographic or network location (for example, blocking or challenging logins from unfamiliar countries)
- Evaluation of calculated risk levels based on behavior or anomalies (for example, triggering additional verification after unusual login activity)
- Sensitivity level of the application or resource being accessed (for example, enforcing stricter controls for financial systems compared to general tools)
Depending on the evaluated signals, possible outcomes may include:
- Requiring additional authentication before access is granted
- Restricting access to limited functionality or read-only modes
- Blocking access entirely when the risk is deemed too high
What extended access security model represents
On the other hand, the extended access model provides users with broader or longer-lasting connectivity after initial authentication. It often prioritizes convenience and continuity over granular control.
Below are common forms of extended access in practice:
- Ongoing remote sessions that remain active for extended periods (for example, an IT administrator maintaining a continuous RDP session to manage multiple servers)
- Network-wide permissions that allow access to multiple internal resources without repeated verification (for example, a user connected to an internal network segment with access to shared systems)
- Continuous VPN connections that keep users linked to the corporate network even when not actively working (for example, an always-on VPN configured on a company laptop)
- Always on access to internal systems (for example, persistent access to file shares or internal applications, without session reauthentication)
This extended access approach supports productivity, but it can significantly increase the impact of a compromised account or device by extending both the duration and scope of access. Persistent sessions give attackers more time to act, while broad access allows them to move across systems without repeated checks, increasing the potential damage before detection.
Note on terminology: In this context, “extended access” refers to session persistence and connectivity scope. This shouldn’t be confused with Extended Access Policies (XAP) or Extended Access Management (XAM), which focus on deeper contextual and device-level evaluation.
Risk modeling differences
Conditional access reduces exposure by making access decisions based on real-time context. Conversely, extended access may increase exposure when access continues beyond the initial verification point.
The following considerations help assess the risk of each approach:
- Whether the system continuously reevaluates device posture
- Whether the session length is controlled
- Whether high-risk situations trigger restrictions automatically
- Whether sensitive resources are isolated
Risk modeling should ultimately determine whether extended access is justified or introduces unnecessary exposure. This means balancing convenience against the potential impact of a compromised session or device.
Visibility and monitoring considerations
Conditional access mainly provides visibility at login by capturing who is trying to access a system and under what conditions. However, once access is granted, the risk shifts to what the user does during the session, especially in extended access scenarios. This will require ongoing monitoring to ensure security.
IT teams should do the tasks below to maintain control over extended access:
- Track how long sessions remain active.
- Detect movement across systems.
- Observe how resources are used.
- Identify attempts to gain higher privileges.
Continuous visibility helps ensure that suspicious behavior after login is still detected and addressed. Without it, organizations can catch risky logins but overlook harmful activity that happens once access is already in place.
Designing a layered access strategy
Conditional access and extended access aren’t viewed as separate or opposing controls. Although they seem to contradict each other in terms of security, they can be made to work together. This task will create multiple checkpoints that manage how access is granted and how it is used over time.
Consider these practices that can help establish a more resilient and balanced access strategy:
- Applying conditional access before a session starts (such as validating identity, device status, and risk signals at login)
- Limiting the scope of extended access (for example, restricting users to only the systems or resources required for their role)
- Prompting users to verify their identity again for sensitive actions (such as approving high-impact changes or accessing critical data)
- Connecting identity insights with session-level monitoring (for example, aligning login context with observed user activity during the session)
Layering these controls helps organizations reduce gaps between authentication and activity. This makes it easier to enforce Zero Trust principles without disrupting day-to-day operations.
Operational governance implications
To keep access controls consistent and manageable, organizations need clear documentation and defined ownership around how conditional and extended access are applied. This structure ensures policies don’t become fragmented or difficult to enforce.
Clearly define these elements as part of governance:
- Roles that are permitted extended access
- Standards for session duration
- Conditions that trigger access decisions
- Procedures for handling access issues
Strong governance helps prevent inconsistent configurations. It also ensures that access policies are applied uniformly, even as environments grow and evolve.
When to use each approach
Choosing between the two strategies depends on various factors, like the level of risk, operational needs, and the sensitivity of the resources involved. Each approach is appropriate in different scenarios, and using them correctly helps avoid unnecessary exposure.
Consider these guidelines for determining the appropriate strategy to use:
- Conditional access is sufficient when access needs to be tightly controlled at entry.
- Extended access is appropriate when users require sustained connectivity.
- Conditional access should be strengthened when risk signals are high.
- Extended access should be limited or avoided when dealing with highly sensitive systems, where persistent or broad access increases potential impact.
Note that most environments benefit from combining both approaches. Use conditional access to gate entry and carefully scope extended access only where operationally necessary.
Balancing access flexibility with risk management
A well-defined access strategy depends on setting controls about who is allowed in, how far their access extends, and how long it remains active. Conditional access and extended access address different problems, so when used together strategically, organizations can make practical and defensible access decisions. Over time, this approach creates a more controlled and transparent environment where access is always aligned with actual risk.
Related topics:
