Explanation:
Box 1: No
User1 is Global Administrator.
User1 is member of Group1.
CA1 includes Group1.
CA1 excludes Global Adminstrators.
The exclusion takes precedence.
CA1 will not be applied to User1.
CA2 does not apply to User1 or Group1, only to Group2 and Group3.
User1 will NOT be prompted for multifactor authentication (MFA).
Note: In Azure Conditional Access policies, exclusion takes precedence over inclusion. This means that if a user is a member of both an included group and an excluded group, the exclusion policy will apply, denying them access or requiring different conditions.
Note 2: When no Azure Conditional Access policies are matched for a user, the user is granted access to the resource without any additional access controls or authentication requirements.
Essentially, it's treated as a normal sign-in. Conditional Access policies don't have a default deny policy, meaning if no policy applies, the user's access is not restricted.
Box 2: Yes
User2 has no role.
User2 is member of Group2.
CA1 excludes Group2.
CA1 will not be applied to User2.
CA2 includes Group2.
CA2 block access to all cloud apps.
CA2 will block access for user to Microsoft SharePoint Online.
Box 3: No
(User3 is Global Reader.)
User3 is member of Group2 and Group3.
CA1 excludes Group2.
CA1 will not be applied to User3.
CA2 includes Group2, and excluded Group3.
The exclusion takes precedence.
CA2 will not be applied to User3.
No Conditional Access policy will be applied to User3.
User3 will not be prevented from signing in to Microsoft SharePoint Online.
Reference:
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access- users-groups
https://learn.microsoft.com/en-us/answers/questions/1004659/how-multiple-conditional-access- policies-are-appli