Explanation/Reference:
Explanation:
There are two types of controls:
Grant controls - To gate access

Session controls - To restrict access to a session

Grant controls oversee whether a user can complete authentication and reach the resource that they're attempting to sign-in to. If you have multiple controls selected, you can configure whether all of them are required when your policy is processed. The current implementation of Azure Active Directory enables you to set the following grant control requirements:

References:
https://blog.lumen21.com/2017/12/15/conditional-access-in-azure-active-directory/