How Do You Require Terms of Use Acceptance in a Conditional Access Policy?

Why the Answer Is Correct

In Microsoft Entra Conditional Access, a terms of use is configured as a grant control: you open Policy1, go to Access controls > Grant, and select the published Terms1 document, optionally combined with Require multifactor authentication, Require compliant device, or other controls. Grant controls are precisely the section that determines whether access is allowed, blocked, or conditioned on an extra requirement such as accepting a ToU. Because the requirement is "users must accept Terms1 before gaining access," the gate belongs in Grant, making C correct. The Microsoft Learn article on requiring terms of use explicitly places "Terms of use" in the grant controls list, which is why nicolaslindt stated that "o enforce Terms of Use (ToU) acceptance in a Conditional Access policy, you must configure it under the Grant section."

Why the Other Options Are Wrong

B. Session is the most attractive distractor: session controls handle sign-in frequency, persistent browser session, and app-enforced restrictions (like Exchange Online or SharePoint limited access), not consent to a legal document. As kosjar described it, a common but incorrect recipe is to "navigate to Security > Conditional Access > Policy1" and then "Under the Session settings, select Terms of Use" — Entra does not expose a ToU picker in Session settings. A. Conditions (users, groups, cloud apps, locations, device platforms, sign-in risk) merely scopes who and what the policy applies to; a condition cannot require acceptance of Terms1. D. Target resources defines the cloud apps, user actions, or authentication context the policy protects, again only scoping the policy rather than enforcing the ToU.

Community Comment Notes

Community consensus aligns with the official documentation: rvln7 summarized it neatly — "if we want to approve or deny access based on ToU" it is a grant control. Btn26 argued for Session with the reasoning that it "ensures that users must accept Terms1 before they can access the resources specified in Policy1," and kosjar gave a step-by-step that routes through Session settings; both reflect how intuitive but incorrect "prompt = session" thinking is. The two learners who cited the Microsoft Learn article on requiring terms of use landed on Grant, and their shared link reinforces that the ToU selection lives in the grant controls of the policy.