https://trustanchor.pro/tags/conditional-access/Recent content in Conditional-Access on Trust AnchorHugo -- gohugo.ioen© 2026 George VaculikSun, 11 Oct 2026 14:30:00 +0200https://trustanchor.pro/posts/jit-ado-via-pim-and-ca-auth-contexts/Sun, 11 Oct 2026 14:30:00 +0200https://trustanchor.pro/posts/jit-ado-via-pim-and-ca-auth-contexts/Azure DevOps organizations tend to carry permanent administrators, because the usual fix, adding people to Project Collection Administrators behind a Conditional Access policy, time-boxes nothing. This post builds the alternative: the permission sits permanently on an Entra group, the human holds only eligible membership, and an authentication context lets a Conditional Access policy gate the activation itself. The design runs on Microsoft Entra tokens with personal access tokens turned off, ends access through a block policy when the membership ends, and names what it does not prevent: the organization owner and direct assignments.