Conditional Access policy naming convention

What Microsoft recommends

Conditional Access is the one area where Microsoft spells out a naming standard. It is short, and it is a good place to start.

Microsoft’s guidance is that a policy name should show five things: a sequence number, the cloud apps, the response, who the policy applies to, and when. The number is there so that two admins can refer to a policy by it, for instance on the phone.

Source: Plan your Microsoft Entra Conditional Access deployment, Microsoft Learn.

So a name should let you answer, without opening the policy: which one is it, who is affected, in which apps, and what happens to them.

A pattern that fits

CA-001-GBL-RequireMfaAllUsers

Policy type - Number - Scope - Purpose

Part	Carries	In the example
Policy type	That this is a Conditional Access policy	`CA`
Number	The sequence number	`001`
Scope	Who it applies to	`GBL`
Purpose	The response, and the apps or the condition	`RequireMfaAllUsers`

The number comes early so that policies sort in the order you review them. The purpose starts with the response (Require, Block) because that is the part that can lock someone out.

Open this pattern in the builder

More examples

CA-002-GBL-BlockLegacyAuthentication

Everyone, all apps, block

CA-010-IT-RequireCompliantDeviceAdmins

Admins, compliant device required

CA-020-BYOD-RequireAppProtection

Personal phones, app protection required

How to number

These are suggestions, not a Microsoft rule:

Three digits. The tenant limit is 240 policies, so three digits are enough and names stay aligned.
Leave gaps. Number in steps of ten, or give each area a range (001 to 099 for everyone, 100 to 199 for admins), so a new policy fits in without renumbering the rest.
Never reuse a number. A retired policy’s number stays retired, or old tickets and audit notes start pointing at the wrong policy.

A tenant can hold at most 240 Conditional Access policies, and policies that are off or in report-only mode count towards that number.

Source: Plan your Microsoft Entra Conditional Access deployment, Microsoft Learn.

Who owns it

Conditional Access policies do not have a built-in owner attribute. Microsoft’s advice is to encode ownership in the policy name, for example with a team prefix, and to keep a registry that maps each policy to a responsible admin or team.

Source: Plan your Microsoft Entra Conditional Access deployment, Microsoft Learn.

In NamingPilot that is the Prefix segment, or a segment of your own. Add it once and save the result as a template.

Emergency policies

Policies you keep switched off for an outage should not look like the others, or someone will tidy them away.

For contingency policies, Microsoft suggests a name that opens with the words ENABLE IN EMERGENCY, then says which disruption it is for, and carries an ordering number so an admin knows which policy to switch on first. Its own example starts “EM01 - ENABLE IN EMERGENCY: MFA Disruption [1/4]”.

Source: Plan your Microsoft Entra Conditional Access deployment, Microsoft Learn.

What to leave out

The state. “Report-only” in a name is wrong the moment you switch the policy on.
Group names. Groups get renamed. Describe who is targeted (Admins, Guests), not which group holds them.
Dates. The audit log already knows when a policy changed.

For the naming of everything else in the tenant, see the Intune naming convention guide.