What Is Cloud Access Security?

Cloud access security is the discipline of governing who and what can reach your cloud services, under which conditions. A CASB is one tool within it; the discipline is broader and the most important parts of it live in your identity provider rather than in any dedicated product.

The shift that makes this its own subject is that network location stopped being a meaningful signal. When the application is not on your network and the user may not be either, “inside” and “outside” no longer describe anything useful.

Identity became the control plane

What replaces network position is a set of signals evaluated at the moment of access: who the user is and how strongly they authenticated, whether the device is managed and healthy, where the request originates, what is being accessed and how sensitive it is, and whether the pattern resembles that user's normal behaviour.

Conditional access policies combine those signals into a decision — allow, allow with additional verification, restrict to a limited session, or deny. This is the substance of cloud access security, and it is configured in the identity provider.

Where these programmes actually fail

Rarely on policy design. The failures are mundane and consistent: legacy authentication protocols left enabled, which bypass modern policy entirely and are used routinely by attackers because they work. Service accounts excluded from conditional access “temporarily” and permanently. Guest and partner identities governed by nobody. Personal devices reaching corporate data through a browser with no device signal at all.

Each of those is an exception that makes the surrounding policy ornamental, and each is invisible unless someone goes looking.

Device posture is the signal most often missing

Identity answers who is asking. Device posture answers what they are asking from, and it is the signal most organisations either do not collect or do not act on.

The practical distinction is between a managed device with disk encryption, current patches and endpoint protection, and an unmanaged personal machine whose state is entirely unknown. Treating those identically means your strongest authentication still ends with sensitive data on a device you know nothing about.

The answer is rarely to block unmanaged devices outright, which breaks contractors, partners and anyone travelling. It is to restrict what the session can do: browser-only access with no download, no offline sync, and shorter session lifetimes. That keeps people working while keeping data off machines you cannot vouch for.

Continuous evaluation is the capability worth asking your identity provider about. Policies checked only at sign-in leave a session valid for its full lifetime regardless of what changes afterwards — the device falling out of compliance, the account being disabled, the risk signal rising. Re-evaluating during a session is what turns those signals into enforcement.

Where to start

Check whether legacy authentication is disabled tenant-wide, and list every identity excluded from conditional access. Those two answers describe your real access posture more accurately than the policy document does.

See SSO and session management and identity governance for contractors. GuardsArm runs cloud security assessments.