Entra ID's policy engine that evaluates every sign-in against conditions — user, application, device state, location, sign-in risk — and enforces controls such as requiring multifactor authentication, a compliant device, or blocking access outright. Policies apply at token issuance, making it the central enforcement point for zero-trust access decisions across Microsoft cloud services and federated apps.